Nonprofit Audit Finding Examples and Fixes

An audit finding is rarely a surprise to an organization that closes its books timely, documents its controls, and gives its board meaningful financial information. Yet nonprofit audit finding examples often reveal the same underlying issue: a sound policy exists on paper, but daily practice has not kept pace with growth, turnover, grant requirements, or funding complexity.

For executive directors, CFOs, controllers, and audit committees, the objective is not simply to receive a clean audit report. It is to obtain the clearest picture your board will ever get of whether the organization’s financial reporting, stewardship, and compliance processes are working as intended. Findings provide that picture when leadership treats them as an accountability tool rather than a year-end inconvenience.

What makes an audit finding significant?

Not every audit adjustment or control recommendation rises to the level of a formal finding. Auditors communicate matters differently depending on their severity, the applicable audit standards, and whether the organization is subject to Uniform Guidance, Yellow Book, HUD, Medicaid, or other program-specific requirements.

In a financial statement audit, a material weakness is a deficiency, or combination of deficiencies, creating a reasonable possibility that a material misstatement will not be prevented or detected timely. A significant deficiency is less severe than a material weakness but important enough to merit governance attention. Other observations may be communicated in a management letter because they represent operational improvements without meeting the threshold for a reportable control deficiency.

For a Single Audit, a finding may address internal control over compliance, noncompliance with a major federal program requirement, questioned costs, or a combination of these matters. The finding must generally describe the condition, the governing criteria, the cause, the effect or potential effect, and a recommendation. Management’s response and corrective action plan become part of the public compliance record.

The distinction matters. A late bank reconciliation is not automatically a material weakness. But if unreconciled accounts conceal recurring errors, delayed grant drawdowns, or unsupported disbursements, the issue may become much more consequential.

Nonprofit audit finding examples boards should understand

Inadequate segregation of duties

A common finding arises when one employee can initiate payments, approve invoices, release funds, and reconcile the bank account. Smaller organizations often face this constraint because their finance teams are lean. The issue is not that a trusted employee is presumed dishonest. The issue is that the control environment does not provide an independent check capable of preventing or detecting error or misuse.

A practical response depends on staffing. A nonprofit may assign a board treasurer or executive director to review bank activity and canceled checks monthly, require dual authorization above established thresholds, restrict online banking permissions, and document the reviewer’s work. The reviewer must do more than receive reports. Evidence of timely, informed review is essential.

Untimely or unsupported bank reconciliations

An organization may reconcile its operating account but fail to reconcile payroll, restricted cash, investment, merchant-service, or program accounts consistently. In other cases, reconciliations are prepared but contain old reconciling items that remain unexplained for months.

This finding can affect more than cash. Unresolved reconciling items may indicate duplicate payments, unrecorded fees, stale checks, or incorrect revenue recognition. A corrective action plan should establish a close calendar, identify the preparer and independent reviewer, require follow-up on items outstanding beyond a defined period, and retain support for the review.

Restricted revenue tracked outside the general ledger

Nonprofits frequently use spreadsheets to monitor grants, donor restrictions, and program budgets. Spreadsheets are often necessary, but they should not become a substitute for reliable accounting records. A finding may occur when the general ledger does not clearly distinguish restricted from without-donor-restriction activity, when releases from restriction are unsupported, or when grant reports do not reconcile to the books.

The risk is both financial and mission-related. Leadership may believe funds are available for general operations when they remain donor-restricted or contractually committed. The remedy is usually a disciplined grant accounting process: establish codes by funding source and program, reconcile grant schedules to the ledger each month, document allowable-cost decisions, and review restriction releases before financial statements are finalized.

Procurement documentation does not meet grant requirements

Organizations receiving federal awards must follow the procurement standards applicable to their awards under 2 CFR Part 200, along with their own written procedures. A familiar Single Audit finding occurs when a nonprofit cannot demonstrate required competition, price analysis, conflict-of-interest disclosures, or approval of a noncompetitive procurement.

The fact that a vendor was qualified, affordable, or known to the organization does not replace required documentation. Procurement files should show the method used, bids or quotations obtained when applicable, the basis for vendor selection, cost or price analysis where required, and approval under the organization’s policy. Requirements can vary by award, procurement method, and applicable threshold, so a generic checklist should be reviewed against the current award terms.

Payroll costs lack reliable support

For human-services providers, education organizations, and agencies administering multiple grants, payroll allocation is often the highest-risk compliance area. An audit finding may result when personnel costs charged to awards are based on unsupported estimates, outdated allocation percentages, or timesheets that do not reflect actual work performed.

A defensible process connects payroll charges to current records of work performed and periodically compares budgeted allocations with actual activity. Supervisory review should be documented, particularly where employees work across programs with different allowability rules. The correct method is not always a daily time sheet. It depends on the award requirements and the organization’s payroll structure. What matters is that the methodology is reasonable, consistently applied, supported, and reviewed.

Weak subrecipient monitoring

When a nonprofit passes federal funds to another organization, it must first determine whether that entity is a subrecipient or a contractor. This classification drives the monitoring responsibility. A finding can occur when the pass-through entity does not perform and document risk assessments, communicate award requirements, review required audit information, or follow up on subrecipient findings.

This is a governance issue as much as a compliance issue. The originating organization remains accountable for its stewardship of public funds. An effective monitoring file commonly includes the executed agreement, risk assessment, reporting requirements, invoices or performance reports, communications, audit review, and evidence of follow-up. More intensive monitoring may be justified for a new subrecipient, a high-risk program, or an entity with prior findings.

Financial statements require extensive auditor adjustments

Auditors are expected to maintain independence. They can identify misstatements and propose adjustments, but management remains responsible for the financial statements and the underlying accounting records. A recurring finding may arise when the organization relies on the audit process to prepare reconciliations, identify major year-end entries, classify net assets, record depreciation, or calculate revenue and receivables.

For some smaller nonprofits, outside assistance in financial reporting is appropriate. The critical question is whether management has the competence, oversight, and documentation to accept responsibility for the statements. A monthly close process, balance-sheet reconciliations, a year-end reporting checklist, and board-level review of meaningful variances can materially reduce this risk.

Turning a finding into a credible corrective action plan

A corrective action plan should not promise that staff will “be more careful.” It should identify a specific control, assign an accountable owner, set a completion date, and explain how management will verify that the control operates over time. If the organization disagrees with a finding, its response should address the facts and applicable requirements directly while still considering whether process improvements are warranted.

Boards should ask management whether the root cause is capacity, training, unclear authority, outdated systems, or inadequate monitoring. The answer determines the remedy. Adding a policy will not solve a staffing problem; hiring additional staff will not solve a process that lacks defined approvals; and neither will solve a grant-compliance issue if personnel do not understand the award terms.

Audit committees also should monitor repeat findings closely. A repeat finding does not always mean management failed to act. Some corrections require a full operating cycle before they can be tested, particularly in federal programs. Still, repeated conditions deserve precise status reporting, evidence of implementation, and clear escalation when deadlines slip.

Preparing before the next audit fieldwork period

The most effective audit readiness work occurs throughout the year. Finance leadership should maintain a close calendar, reconcile significant accounts monthly, retain approval evidence, update grant files as awards change, and bring meaningful exceptions to the attention of management and the board. Internal-control assessments can be particularly valuable after a merger, leadership transition, new funding stream, system conversion, or rapid program expansion.

Goldenthal & Suss approaches audit findings with the technical rigor required by regulators and the practical judgment leadership teams need to make improvements that will hold up under future scrutiny. The right response is proportionate to the organization’s size and risk profile, but it must be real, documented, and capable of operating consistently.

A well-addressed finding can strengthen more than the next audit report. It can give the board better visibility, give management clearer ownership of risk, and protect the resources entrusted to the organization’s mission.