Guide to Federal Audit Findings for Grant Leaders

A federal audit finding is not simply an unfavorable line in a report. For an organization receiving federal awards, it is a documented statement that a compliance requirement, internal control, or financial practice did not operate as required. This guide to federal audit findings is designed for CFOs, controllers, executive directors, and board leaders who need to respond with precision while protecting funding, credibility, and mission delivery.

For entities subject to a Single Audit under Uniform Guidance, findings become part of the auditor's schedule of findings and questioned costs and may be reviewed by pass-through entities, federal awarding agencies, lenders, regulators, and governing bodies. The most effective response is neither defensive nor generic. It is specific, evidence-based, and tied to a corrective action that can be sustained after the audit is complete.

What Federal Audit Findings Actually Mean

A finding generally arises when an auditor identifies a condition that meets the reporting criteria under 2 CFR Part 200. The issue may involve noncompliance with a federal program requirement, a deficiency in internal control over compliance, questioned costs, or a combination of these matters.

The terminology matters. A control deficiency is not automatically evidence that funds were misused. Likewise, a questioned cost is not always a final disallowance. It is an expenditure identified for review because it may be unsupported, unallowable, improperly allocated, or otherwise inconsistent with program requirements. Those distinctions should shape both management's internal assessment and its communication with the board.

A well-written finding usually identifies the federal program and assistance listing number, the applicable compliance requirement, the condition observed, the criteria that were not met, the cause, the possible effect, and any questioned costs. It should also identify whether the matter is a significant deficiency or material weakness in internal control over compliance. Management should read every element carefully. The condition tells you what happened; the cause and effect help determine what must change.

Common Types of Federal Audit Findings

Federal findings differ by program, but several patterns recur across nonprofit organizations, public entities, schools, healthcare and human-services providers, and housing organizations.

Eligibility findings can occur when recipient, participant, tenant, student, or client files do not contain support for required eligibility determinations. Procurement findings often involve missing price or rate quotations, incomplete conflict-of-interest documentation, inadequate vendor selection records, or failure to apply the required procurement standards. Payroll and time-and-effort issues may arise when personnel costs charged to awards are not supported by records that accurately reflect work performed.

Other recurring areas include late or inaccurate financial reporting, unsupported indirect cost allocations, inadequate subrecipient monitoring, missing required program income documentation, and charges made outside a grant period of performance. For HUD-funded entities, findings may involve tenant files, rent calculations, reserve activity, or program-specific reporting. For school districts and municipalities, the facts may center on procurement, cash management, special education programs, or pass-through grant administration.

The same underlying weakness can produce different findings depending on the program and facts. A missing approval on one invoice may be isolated. Repeated missing approvals across a tested population may indicate that the organization lacks an operating review control. That is why management should focus on the process, not merely the individual exception.

How to Read a Federal Audit Finding Before Responding

Start by confirming the factual record. Review the auditor's samples, source documents, correspondence, policies, grant agreements, and prior-year findings. If management has evidence that changes the factual conclusion, provide it promptly during the audit process. Once a finding is finalized, the goal shifts from debating language to building a credible corrective action plan.

Then assess the scope. Ask whether the exception is limited to the items tested or whether it signals a broader population risk. For example, an unsupported procurement file may warrant a review of all purchases over the relevant threshold, especially if the missing documents reflect a gap in centralized recordkeeping rather than an isolated oversight.

Management should also distinguish between a policy problem and an execution problem. A policy may meet Uniform Guidance requirements but not be followed consistently. Alternatively, staff may be following an outdated policy that no longer reflects current federal requirements or the organization's actual workflow. The remedy is different in each case. Retraining alone rarely resolves a policy design failure.

Determine Whether Questioned Costs Require Immediate Action

When questioned costs are identified, quantify the exposure and preserve the supporting records. Determine whether the cost can be supported through documentation that was available but not initially provided, whether it can be reclassified appropriately, or whether repayment, reimbursement adjustment, or further direction from the awarding agency may be required.

Do not assume an audit finding itself establishes a final repayment obligation. Federal agencies and pass-through entities make their own determinations. Still, waiting for an agency decision is not a sound risk-management strategy. Leadership should understand the potential financial exposure, cash implications, and any restrictions on future drawdowns or awards.

Building a Corrective Action Plan That Agencies Can Trust

Under Uniform Guidance, the corrective action plan is management's document. It should not repeat the auditor's recommendation in different words. It should state what the organization will do, who is accountable, when the action will be complete, and how leadership will verify that the new control is operating.

A credible plan identifies the root cause in plain terms. “Staff error” is usually too vague to be useful. Better explanations identify the operational breakdown: decentralized invoice retention, unclear grant coding, no secondary review of procurement files, inconsistent subrecipient risk assessments, or inadequate training for a newly assigned program manager.

The action steps should be practical and measurable. If procurement documentation was incomplete, management may revise the procurement checklist, require pre-award approval from finance, centralize records in a controlled repository, train purchasing staff, and conduct periodic file reviews. Each step addresses a different part of the control environment. The right combination depends on transaction volume, staffing structure, program risk, and whether the organization operates through multiple sites or affiliates.

Avoid promises that cannot be verified, such as “management will be more diligent.” A stronger commitment is: “The controller will review a monthly sample of procurement files for required documentation beginning July 1, retain the review log, and report exceptions to the CFO for remediation.” That language establishes ownership, frequency, evidence, and escalation.

Management's Response Should Be Accurate, Not Argumentative

Management may agree, partially agree, or disagree with a finding, but the response must remain professional and fact-driven. If management disagrees, explain the basis with reference to the applicable requirement and available documentation. A disagreement should never obscure the organization's responsibility to address any underlying process weakness.

When management agrees, avoid language that overstates the problem or admits conclusions beyond the auditor's finding. “The organization has implemented corrective measures to strengthen documentation and review procedures” is more accurate than broadly characterizing the entire program as noncompliant. Precision protects the organization and gives boards and regulators a clearer picture of the actual risk.

The response should also reflect timing honestly. If corrective action is underway but not complete, say so. Agencies and pass-through entities are more likely to view a plan favorably when it includes realistic milestones, rather than an assertion that an issue has been solved before new controls have been tested.

The Board's Role in Federal Audit Findings

Boards and audit committees do not need to manage each corrective task, but they have a critical oversight role. They should understand the nature of the finding, its programmatic and financial implications, management's remediation timeline, and whether similar risks exist elsewhere in the organization.

A useful board discussion focuses on accountability. Who owns the correction? What resources are needed? What evidence will demonstrate completion? Is the issue connected to staff turnover, systems limitations, rapid program growth, or a governance gap? For significant deficiencies, material weaknesses, or repeated findings, the audit committee should receive periodic status reporting until management can demonstrate sustained compliance.

This is also where an audit can provide the clearest picture your board will ever get of how federal funds move through the organization. A finding may reveal that mission activity has outgrown informal processes. Treating that signal seriously can improve grant administration well beyond the program examined.

Preventing Repeat Findings

Repeat findings draw heightened attention because they suggest that a prior corrective action was incomplete, poorly designed, or not maintained. Prevention begins with ownership after the reporting package is submitted, not just before the next audit begins.

Maintain a corrective-action tracker with responsible parties, due dates, supporting evidence, and a status review cadence. Test the revised control before the next audit cycle. If a new checklist is required, confirm that staff use it and that reviewers retain proof of review. If a policy changes, make sure the workflow, forms, systems access, and staff training all support the change.

Organizations should also perform targeted internal monitoring in high-risk areas throughout the year. The appropriate depth depends on federal expenditure levels, the number of programs, prior audit history, turnover, and the complexity of subrecipient relationships. A small organization may need disciplined monthly review by finance leadership; a larger institution may need formal compliance testing and audit committee reporting.

Federal audit findings deserve prompt attention because they speak directly to stewardship of public funds. With a disciplined fact review, a specific corrective action plan, and meaningful board oversight, an audit finding can become a practical turning point: stronger controls, clearer accountability, and greater confidence in the organization's ability to carry out its federally funded mission.