Government Auditing Standards (The Yellow Book): A Comprehensive Guide

Government Auditing Standards, also called the Yellow Book or GAGAS, are audit standards issued by the U.S. Government Accountability Office (GAO). Auditors follow them when a law, regulation, contract, grant agreement, or policy requires it, most often for audits of governments and federal award recipients. For financial audits, GAGAS adds internal control and compliance reporting to AICPA standards.

Source: GAO Yellow Book (2024 revision), paragraphs 6.01 and 6.02, and the chapter 6 section on reporting on internal control and compliance.

Which revision applies? The 2024 revision is effective for financial audits, attestation engagements, and reviews of financial statements for periods beginning on or after December 15, 2025, and for performance audits beginning on or after December 15, 2025. Early implementation is permitted. For earlier periods, the 2018 revision (Technical Update April 2021) applies unless the auditor implements the 2024 revision early.

For example, a fiscal year ending June 30, 2026 began on July 1, 2025, so its audit follows the 2018 revision unless the auditor implements the 2024 revision early. A calendar-year 2026 audit follows the 2024 revision.

Audit organizations generally had to design and implement a system of quality management by December 15, 2025, and should complete their first evaluation by December 15, 2026. GAO provides an exception for federal government audit organizations: they could defer implementation until no later than March 16, 2026, and should complete the evaluation within one year of implementation.

Build your auditing foundation with the Farhat Lectures Auditing course.

Prefer to watch? This lecture explains Yellow Book reporting, materiality, and audit opinions for AUD. It was published in 2018; use this article’s current guidance for revision effective dates, quality management, and the Single Audit threshold.

Topics in This Article

1. What Do Government Auditing Standards Cover?
2. What is the difference between GAAS and the Yellow Book?
3. Comparing Three Common Financial Audit Engagements
4. How does materiality differ in government audits?
5. What Opinions Can an Auditor Issue in a Government Audit?
6. What Are the Yellow Book Independence Rules?
7. How Many CPE Hours Does the Yellow Book Require?
8. CPA Exam Focus: Critical Takeaways for AUD
9. Frequently Asked Questions

What Do Government Auditing Standards Cover?

The Yellow Book is more than a financial audit rulebook. The 2024 revision has nine chapters:

Chapters	What they cover
1 and 2	Foundation, types of GAGAS engagements, and how to state GAGAS compliance in a report
3	Ethics, independence, and professional judgment
4	Competence and continuing professional education (CPE)
5	Quality management, engagement quality reviews, and peer review
6	Standards for financial audits
7	Attestation engagements and reviews of financial statements
8 and 9	Fieldwork and reporting standards for performance audits

Chapter 5 is where the 2024 revision made its biggest change. It replaced the old quality control approach with a risk-based system of quality management.

GAGAS covers four types of engagements: financial audits, attestation engagements, reviews of financial statements, and performance audits. A performance audit looks at things like program effectiveness, efficiency, internal control, or compliance, rather than at whether financial statements are fairly presented.

Who has to follow it? GAGAS applies when a law, regulation, contract, grant agreement, or policy requires it, or when an auditor chooses to follow it. Two common examples:

• The Single Audit Act requires GAGAS for Single Audits of state and local governments and nonprofits that receive federal awards.
• The Chief Financial Officers Act requires GAGAS for audits of major federal agencies’ financial statements.

Want the lecture version? Review the Farhat Lectures lesson on Government Auditing Standards.

What is the difference between GAAS and the Yellow Book?

For financial audits, Government Auditing Standards (GAGAS) incorporate the AICPA’s Statements on Auditing Standards and add requirements. The applicable standards depend on the engagement:

• GAAS (Generally Accepted Auditing Standards): AICPA auditing standards apply to financial statement audits of nonissuers. A nonissuer is an entity that is not an issuer (generally, a publicly traded company with SEC reporting obligations), such as a privately held company, a nonprofit organization, or a government entity.
• The Yellow Book (GAGAS): For financial audits, it incorporates AICPA auditing standards and adds requirements, including reporting on internal control and compliance. GAGAS applies when required by applicable law, regulation, an agreement, or policy, or when voluntarily adopted; receiving public funds alone does not establish applicability.

Comparing Three Common Financial Audit Engagements

The following comparison illustrates how requirements can expand across three common engagements. It is a teaching comparison, not an official hierarchy covering every government audit. GAGAS also addresses performance audits, attestation engagements, and reviews of financial statements.

Engagement	Primary Scope	Key Reporting Distinction
GAAS financial statement audit	Financial statements evaluated against the applicable financial reporting framework.	An opinion on the financial statements, or a disclaimer when appropriate. An audit does not by itself provide an opinion on internal control.
GAGAS financial audit	A financial audit under the incorporated AICPA standards and additional Yellow Book requirements.	Financial statement reporting plus reports on internal control over financial reporting and compliance. These additional reports describe testing and findings; GAGAS does not by itself require opinions on internal control or compliance.
Single Audit	A GAGAS financial audit, the schedule of expenditures of Federal awards (SEFA), and testing of major Federal programs and related controls.	Financial statement and SEFA reporting, plus an opinion (or disclaimer) on compliance for each major program and a report on internal control over compliance. The control report is not an opinion on control effectiveness.

Under current 2 CFR § 200.501, a non-Federal entity expending $1,000,000 or more in Federal awards during its fiscal year generally needs a Single Audit, unless it qualifies for and elects a program-specific audit. This threshold applies to fiscal years beginning on or after October 1, 2024. For earlier fiscal years, the threshold was $750,000.

The federal audit requirements are in 2 CFR Part 200, Subpart F (Uniform Guidance). Section 200.514 sets the audit scope, including GAGAS and major-program compliance testing; Section 200.515 specifies required reports, including the major-program compliance opinion and findings and questioned costs.

Example: Applying Government Auditing Standards

Assume Cedar County spends money repairing roads. Compare the work required under three possible audit engagements:

1. Financial statement audit (GAAS): The auditor checks whether road-repair expenditures and related payables are properly recorded, supporting an opinion on the financial statements.
2. GAGAS financial audit: When Yellow Book standards also apply, the auditor adds reporting on internal control over financial reporting and compliance. For example, a significant deficiency in purchase approvals is reported. A significant deficiency is a control weakness that is less severe than a material weakness but important enough to deserve the attention of those charged with governance. This additional report does not express an opinion on internal control or compliance.
3. Single Audit: If a Single Audit is required and a federal highway grant is a major program, the auditor also tests grant compliance and related controls, including whether charged road costs are allowable. A major program is a federal program the auditor selects for detailed compliance testing using the risk-based process in 2 CFR § 200.518. The auditor expresses an opinion on compliance for the major program.

Does Cedar County need a Single Audit?

Suppose Cedar County’s fiscal year runs from July 1, 2025, to June 30, 2026, and it expends $1,200,000 of federal awards. That is at least $1,000,000, so a Single Audit is required (or a program-specific audit, if the county qualifies and elects one).

If the county had expended $900,000 instead, no Single Audit would be required, because its fiscal year began after October 1, 2024. Under the old $750,000 threshold, that same $900,000 would have triggered one.

Watch for this on the exam: the test is federal awards expended, not awards received.

For further explanation, review the Farhat Lectures lesson on governmental financial auditing.

---

How Does Materiality Differ in Government Audits?

A misstatement, including an omission, is material if it could reasonably influence users’ decisions, individually or together with other misstatements. Materiality depends on the amount, nature, and circumstances of the misstatement. In a government audit, auditors may find it appropriate to use a lower materiality level. GAO Yellow Book paragraph 6.03 gives three reasons: public accountability, legal and regulatory requirements, and the visibility and sensitivity of government programs. It does not require a lower threshold in every case.

• The Reasoning: Public accountability and sensitive programs can make smaller misstatements significant to users.
• The Impact: A lower materiality level can affect the extent of testing. Procedures and sample sizes depend on assessed risks and audit objectives.
• Opinion Units: For state and local government financial statements, auditors assess materiality for each relevant opinion unit, such as governmental activities, business-type activities, and each major fund (AICPA Audit and Accounting Guide, State and Local Governments).

Review our Materiality Concept in Auditing lesson to strengthen your understanding of this concept.

What Opinions Can an Auditor Issue in a Government Audit?

A financial statement audit seeks reasonable assurance that the statements are free of material misstatement from fraud or error. This is a high level of assurance, but an audit cannot guarantee that every material misstatement will be detected. The auditor reports an opinion or a disclaimer; for state and local government financial statements, reporting addresses the relevant opinion units.

1. Unmodified (Clean): The auditor concludes that the financial statements present fairly, in all material respects, in accordance with the applicable financial reporting framework. Explore the conditions for an unmodified opinion in this Farhat Lectures lesson.
2. Qualified: The statements are fairly presented except for the effects of an identified material misstatement, or the possible effects of a matter for which sufficient appropriate audit evidence could not be obtained. The effects, or possible effects, are material but not pervasive.
3. Adverse: The auditor has sufficient appropriate evidence and concludes that misstatements are material and pervasive. The financial statements do not present fairly in accordance with the applicable financial reporting framework.
4. Disclaimer: The auditor expresses no opinion. This is required when sufficient appropriate audit evidence cannot be obtained and the possible effects of undetected misstatements could be material and pervasive.

Quick definition: “pervasive” means the effects are not confined to specific accounts or items, or, if they are, they represent a substantial portion of the financial statements or affect disclosures that are fundamental to users’ understanding (AU-C 705).

See AU-C sections 200, 700, and 705 in AICPA’s currently effective auditing standards for the underlying assurance and reporting requirements.

Additional Single Audit Reporting

A Single Audit adds pieces you will not see in a regular financial statement audit:

• An “in relation to” opinion on the schedule of expenditures of federal awards (SEFA). The auditor says whether the SEFA is fairly presented in relation to the financial statements as a whole.
• An opinion, or a disclaimer, on compliance for each major program. Materiality for this opinion is judged program by program, not for the financial statements as a whole.
• A report on internal control over compliance, which describes testing but is not an opinion.
• A schedule of findings and questioned costs.

See 2 CFR § 200.515.

What Are the Yellow Book Independence Rules?

GAGAS has its own independence standard, and the CPA exam tests it separately from the AICPA Code. Auditors must be independent of the audited entity in both mind and appearance. That covers the period covered by the financial statements and the period of the professional engagement.

GAGAS uses a conceptual framework with three steps:

1. Identify threats to independence.
2. Evaluate how significant those threats are, one by one and in total.
3. Apply safeguards to eliminate the threats or reduce them to an acceptable level.

The seven threat categories are self-interest, self-review, bias, familiarity, undue influence, management participation, and structural.

Two rules students often miss:

• If an auditor takes on a management responsibility for the audited entity, such as designing or maintaining internal control or having custody of the entity’s assets, independence is impaired. No safeguard can fix that.
• Preparing financial statements in their entirety from a client’s trial balance creates a significant threat. The auditor must document the threat and the safeguards applied, or decline the service.

Source: GAO Yellow Book, chapter 3, paragraphs 3.20, 3.27, 3.30, 3.78, and 3.88.

How Many CPE Hours Does the Yellow Book Require?

Auditors who plan, direct, perform procedures for, or report on GAGAS engagements need at least 80 hours of continuing professional education (CPE) every two years:

• At least 24 hours in subjects directly related to government auditing, the government environment, or the audited entity’s specific environment.
• The remaining 56 hours in subjects that directly build the auditor’s professional expertise to conduct engagements.
• At least 20 hours in each year of the two-year period.

The audit organization may exempt an auditor from the 56-hour requirement, but not the 24-hour requirement, if the auditor charges less than 20 percent of annual time to GAGAS engagements and only performs engagement procedures, without planning, directing, or reporting on the engagement. This exemption is not automatic. The organization may also exempt nonsupervisory auditors who charge less than 40 hours annually to GAGAS engagements from the CPE requirements in paragraph 4.16.

Source: GAO Yellow Book, chapter 4, paragraphs 4.16–4.17 and 4.25–4.26.

CPA Exam Focus: Critical Takeaways for AUD

The AICPA Uniform CPA Examination Blueprints effective January 2026 test government auditing in several places in the Auditing and Attestation (AUD) section:

• Area I.A.3: GAO ethics and independence requirements (blueprint pages AUD7 to AUD8)
• Area I.C.2: the nature, scope, and objectives of GAGAS engagements, including Single Audits (page AUD8)
• Area II.G.4: when an entity needs a Single Audit, including identifying federal awards and major programs (page AUD16)
• Area III.E.6: testing federal award transactions for compliance (page AUD21)
• Area IV.E.5: additional GAGAS reporting on internal control and compliance, plus the Single Audit compliance report and the schedule of findings and questioned costs (page AUD24)

Use the blueprint that applies to your exam date, available on AICPA’s official blueprint page.

Common Exam Traps

• “Reporting on” is not “an opinion on.” A GAGAS financial audit requires reporting on internal control and compliance; GAGAS alone does not require opinions on either.
• The Single Audit trigger is federal awards expended, not received.
• A Single Audit gives a compliance opinion for each major program, but the report on internal control over compliance is still not an opinion.
• GAGAS independence is its own standard. Taking on a management responsibility impairs independence, with no exceptions.

Quick Practice Question

Under Government Auditing Standards, what must the auditor’s report on internal control over financial reporting include in a financial audit?

A. An opinion on the effectiveness of internal control
B. A description of the scope of testing and a statement on whether the tests provided sufficient, appropriate evidence to support an opinion on internal control
C. Nothing, unless the auditor found a material weakness
D. Only the deficiencies management has already corrected

Answer: B. GAGAS requires a description of the testing scope and a statement on whether the tests supported an opinion. It does not require an opinion, and the report is issued whether or not deficiencies are found.

Continue your AUD preparation with the Farhat Lectures AUD CPA Test Bank.

---

Government Auditing Standards: Frequently Asked Questions

What is the Yellow Book in accounting?

The Yellow Book is GAO’s Government Auditing Standards (GAGAS). It establishes requirements for auditors and audit organizations performing covered financial audits, attestation engagements, financial statement reviews, and performance audits.

How do GAAS financial statement audits, GAGAS financial audits, and Single Audits differ?

A GAAS financial statement audit addresses the financial statements. A GAGAS financial audit adds Yellow Book requirements, including internal control and compliance reporting without automatically requiring opinions on either. A Single Audit adds Federal award reporting and major-program testing, including a compliance opinion or disclaimer and a report on related controls.

How does materiality differ in government audits?

Public accountability and sensitive programs may make smaller misstatements material. A lower threshold is not mandatory in every government audit; auditors consider both quantitative and qualitative factors and the relevant opinion units.

Who has to follow Government Auditing Standards?

GAGAS applies when required by a law, regulation, contract, grant agreement, or policy, or when voluntarily adopted. Receiving public funds alone does not establish that GAGAS applies.

Which Yellow Book revision applies to my audit?

The 2024 revision applies to financial audits, attestation engagements, and reviews of financial statements for periods beginning on or after December 15, 2025, and to performance audits beginning on or after that date. Earlier periods follow the 2018 revision unless the auditor implements the 2024 revision early.

How many CPE hours does the Yellow Book require?

Generally, 80 hours every two years, including at least 24 government-related hours and at least 20 hours each year. The audit organization may grant an exemption from the 56-hour requirement when an auditor spends less than 20 percent of annual time on GAGAS engagements and only performs procedures, without planning, directing, or reporting.

What is the Single Audit threshold?

A non-federal entity that expends $1,000,000 or more in federal awards in a fiscal year beginning on or after October 1, 2024, generally needs a Single Audit, or a program-specific audit if it qualifies and elects one. For earlier fiscal years, the threshold was $750,000.

---

Want to see how I teach before you sign up? Start with the free Farhat Lectures sample course. When you are ready to practice exam-style questions, the AUD CPA Test Bank is waiting.

About the Author

Professor Mansour Farhat, DBA, CPA, CIA, MAcc is an accounting educator and the founder of Farhat Lectures. He earned a Doctor of Business Administration from Temple University and a Master of Accountancy from Bloomsburg University. His lessons help accounting students and professional exam candidates understand concepts through explanations and practical examples.

Last reviewed for accuracy: October 30, 2026.