The American Institute of Certified Public Accountants (AICPA) has made enhancive changes to the Government Auditing Standards and Single Audits - Audit Guide (the Guide or GAS/SA Guide) and included those in the 2025 edition of the Guide as Appendix B. These changes will become the content in Part II – Single Audits Under the Uniform Guidance, in the 2026 GAS/SA Guide once issued later in 2026. The revisions are designed to strengthen audit execution under the Uniform Guidance.
The updates apply specifically to auditors performing engagements under the Uniform Guidance and introduce sharper risk assessment procedures, more robust internal control testing, expanded scrutiny of IT applications, and tighter expectations around noncompliance findings.
Auditees may notice certain impacts on their audits and their required time commitment while working through a single audit with their auditors. The extent of the impact will vary by auditee. For auditees, it likely means more audit requests, more documentation, and more time from finance, compliance, and program personnel. The degree of impact will vary depending on the auditee’s size, complexity, systems, and federal programs.
One of the most significant changes is the auditor’s enhanced process for identifying and assessing the risk of material noncompliance (RMNC). This process needs to take into account whether the RMNC is due to fraud or error for each applicable compliance requirement. The RMNC identified needs to be at the appropriate level of granularity based on each auditor’s professional judgment. The more granular approach means auditees should expect deeper conversations about processes, controls, and where compliance breakdowns could occur. Auditors must also determine whether the controls in place are specific and precise enough to address each identified risk. The risk assessment process required to be performed by auditors depends on discussions with auditee management. As a result of the enhancements related to risk assessment, the auditee may experience an increase in questions and requests for documentation from their auditors as well. Auditees may need to spend more time preparing clear process narratives or memos for each direct and material compliance requirement, and management should expect more targeted questions during planning and fieldwork.
Once the controls are identified, auditors will need to test them using the applicable control sampling guidance and evaluate whether they are operating effectively. The greater the reliance that an auditor plans to place on a control, the more persuasive the audit evidence needs to be.
The auditee needs to be detailed in providing the processes utilized. Auditees will need to clearly explain how their processes work, what controls are in place, and how those controls mitigate compliance risks. In some cases, auditors may need to test a combination of controls rather than a single control, particularly when inherent risk is higher. This need can translate into broader requests for documentation, walkthrough support, and evidence that controls operated consistently throughout the audit period.
The revised guide also raises the bar for IT-related testing utilized in areas impacted by the single audit. Auditees may be asked more detailed questions by their auditors about IT systems used to process, monitor, or report activity and the related controls that are utilized with regard to the direct and material compliance requirements. Auditees may need to provide system information, identify relevant automated controls, and coordinate with IT personnel to support testing to ensure compliance requirements are met. Auditees may also have to run specific procedures and certain tests procedures on IT systems at the request of the auditor, so they can evaluate system-based controls. Auditees may also feel the impact through larger sample sizes. The suggested minimum sample sizes in the GAS/SA Guide for both control testing and compliance testing have been revised. Depending on the auditor’s risk assessment, the effectiveness of controls, and the size of the transaction population, auditees may be asked to provide support for more transactions than in prior years. This additional ask can increase the time needed to gather records and respond to audit requests.
Another meaningful change relates to how control deviations and noncompliance are evaluated. Under Appendix B, auditees will be expected to help identify the cause of deviations and instances of noncompliance and assess the full monetary impact. This assessment will require additional time, and the analysis may require significant staff effort, especially where findings are complex or affect multiple transactions or funding sources. Auditors will also need sufficient support to validate management’s conclusions.
In summary, auditees should be prepared for more rigorous single audits performed under the 2026 AICPA GAS/SA Guide, which could result in more time and effort. The changes are likely to increase the time, coordination, and documentation required by management, accounting teams, program staff, and IT personnel, and may also contribute to higher audit fees. Auditees can reduce surprises by discussing these changes with their auditors during the planning process.