A grant-funded client hands your team a trial balance and asks you to prepare the financial statements you will later audit. The same question surfaces on the next single audit, and the one after that: does this nonaudit service impair your independence under the Yellow Book?
Get the call wrong and the cost is real. A weak independence conclusion can fail peer review, force a redo, or put the report itself in question.
This article covers what GAGAS is, who must follow it, and how its independence, CPE, and peer review rules work. It also shows how GAGAS relates to GAAS and the Green Book, with key points tied to citable authority.
The Yellow Book is the GAO's Government Auditing Standards, abbreviated GAGAS. It applies to auditors of government entities and organizations that expend federal awards, whenever GAGAS is required by law, regulation, contract, grant agreement, policy, or a single audit.
The name can cause confusion because more than one professional publication is informally called the Yellow Book. In audit work, "Yellow Book" usually means GAO's Government Auditing Standards, not the Uniform Appraisal Standards for Federal Land Acquisitions or other unrelated publications also informally called the Yellow Book.
GAO issued the 2024 revision of Government Auditing Standards, GAO-24-106786, in February 2024. It supersedes the 2018 Revision Technical Update, but its effective date depends on the engagement: it applies to financial audits, attestation engagements, and reviews of financial statements for periods beginning on or after December 15, 2025, and to performance audits beginning on or after December 15, 2025. Early implementation is permitted, and the 2018 version still governs periods that began earlier.
A GAGAS-compliant system of quality management is required to be designed and implemented by December 15, 2025, with the audit organization completing its first evaluation of that system by December 15, 2026. For nonfederal audit organizations, that December 15, 2025 date stands. Per GAO's own Yellow Book page, because of the lapse in federal appropriations that ran from October 1 through November 12, 2025, "a federal government audit organization may defer the design and implementation of its system of quality management until no later than March 16, 2026," a narrower exception that does not extend to state, local, nonprofit, or CPA-firm audit organizations. A federal organization using the deferral should complete its evaluation within one year of implementation, rather than the general December 15, 2026 date.
GAGAS names four engagement types by objective, and the applicable standards change with each. Fix the type first, before you apply any rule.
Attestation engagements and reviews of financial statements draw on the same GAGAS chapters (1 through 5 and 7), so the practical rulebook splits three ways even though GAGAS names four engagement types.
Auditors must follow GAGAS whenever required by law, regulation, contract, grant agreement, policy, or a single audit requirement. Three federal mandates drive most of this work (GAGAS para. 1.09).
The single audit trigger is the one most engagement managers watch. Under 2 CFR 200, § 200.501 sets the threshold: "A non-Federal entity that expends $1,000,000 or more in Federal awards during the non-Federal entity's fiscal year must have a single audit conducted in accordance with § 200.514," for fiscal years beginning on or after October 1, 2024. Section 200.501 determines whether a single audit or program-specific audit applies; § 200.514's audit-performance rules then require the auditor to perform that audit in accordance with GAGAS. Many competitor pages still cite the old $750,000 figure; the 2024 Uniform Guidance revision raised it to $1,000,000.
Independence under GAGAS has two parts. Independence of mind is the state of mind that lets you conduct the engagement without influences that compromise professional judgment. In appearance, it means no circumstances exist that would lead a reasonable, informed third party to conclude your objectivity was compromised.
GAGAS uses a conceptual framework for most independence evaluations: you identify threats, evaluate their significance alone and in aggregate, then apply safeguards to reduce them to an acceptable level. But not every issue is a safeguards analysis. Some circumstances, including assuming management responsibilities, impair independence and cannot be reduced to an acceptable level through safeguards.
Two threat categories drive most nonaudit-service questions. A self-review threat arises when you would evaluate your own prior work. A management participation threat arises when you take on a management role.
Because the framework weighs facts, the same service can resolve differently across engagements. That is where managers get stuck, and where documentation matters most.
A self-review threat is the risk that an auditor who provided a nonaudit service will not objectively evaluate that work when auditing it. In plain English, it is the risk of auditing your own prior work.
Before you agree to any nonaudit service, GAGAS requires three steps:
Two lines are firm. Preparing financial statements in their entirety from a client-prepared trial balance or underlying accounting records creates significant threats under GAGAS paragraph 3.88. Document the threats, the safeguards applied, and your assessment that those safeguards actually reduce the threats to an acceptable level; if they don't, decline the nonaudit service or the GAGAS engagement.
Assuming management responsibilities is an impairment that no safeguard can cure.
The SKE assessment and written understanding are where single audits fail peer review. Treat them like documenting a defensible position: specific, cited, and reviewable.
CPE under GAGAS applies based on the auditor's role and level of involvement in GAGAS engagements. Engagement partners, managers, in-charges, reviewers, and staff who perform GAGAS work should be evaluated against the Yellow Book's CPE categories, and because the requirements depend on role and time charged, audit organizations should document each covered person's classification under the current GAGAS CPE paragraphs. CPE is measured over a rolling two-year period at the individual auditor level.
Peer reviewers test these records directly, so the split and the annual floor matter as much as the total.
Each covered auditor must complete at least 80 hours of CPE every two years. At least 20 of those hours must fall in each year of the period. The hours must enhance the expertise needed for the engagements performed.
Excess hours do not carry over. GAGAS bars carrying hours earned above the requirement from one two-year period into the next.
GAGAS requires that of the 80 hours, at least 24 relate to government subject matter, guidance the AICPA restates in its 24-hour government CPE rule: "At least 24 of the 80 hours of CPE should be in subjects directly related to government auditing, the government environment, or the specific or unique environment in which the audited entity operates."
Qualifying topics include GASB standards, 2 CFR 200 and the Compliance Supplement, GAGAS itself, and the client's specific program area. The remaining 56 hours can cover broader subjects that build audit expertise.
Every audit organization running GAGAS engagements must maintain a system of quality management. The 2024 revision renamed this from quality control and expanded it, and peer review tests whether the system is designed well and followed.
Under GAGAS Chapter 5, each organization must obtain an external peer review by independent reviewers at least once every three years. A new organization must complete its first review within three years of starting its first GAGAS engagement.
Organizations already in a recognized program, such as the AICPA or the Council of the Inspectors General on Integrity and Efficiency, follow that program plus the specified GAGAS paragraphs. The files peer reviewers open are the same independence and CPE records covered above, so keep them current.
GAGAS builds on the AICPA's auditing standards. For financial audits it incorporates the Statements on Auditing Standards (GAAS) by reference. For attestation work it incorporates the SSAE, then adds government-specific requirements on top.
One point trips people up. GAGAS does not incorporate the AICPA Code of Professional Conduct by reference, though CPAs may still be subject to the Code independently (para. 2.14).
The Green Book is an internal control framework, not an audit standard, and it works alongside GAGAS rather than instead of it. Per the GAO, the 2025 Green Book states that "The 2025 revision of Standards for Internal Control in the Federal Government contains changes from, and supersedes, Standards for Internal Control in the Federal Government (GAO-14-704G) issued in September 2014," effective beginning with fiscal year 2026, with early adoption permitted. Federal executive agencies must use it for internal control under the Federal Managers' Financial Integrity Act; other federal and nonfederal entities, including state, local, and nonprofit organizations, may adopt it as a framework based on their own applicable laws, regulations, and management's determination. The 2024 Yellow Book still cross-references the 2014 version.
For CPAs performing GAGAS engagements, the AICPA Code may apply independently through licensure, firm policy, or AICPA membership, and GAGAS layers its own additional requirements on top regardless. Three areas show the gap.
Nonaudit-service documentation: GAGAS requires the SKE assessment and a written understanding that the AICPA Code does not demand in the same form.
Preparing financial statements: GAGAS treats financial statements prepared in their entirety from a trial balance or underlying accounting records as creating significant threats (para. 3.88). Under the AICPA Code (ET §1.295.040), preparing financial statements for an attest client is often permissible as a nonattest service if management accepts responsibility, oversees the service, evaluates the results, and the member does not assume management responsibilities. The GAGAS analysis is more demanding.
Conceptual approach: GAGAS applies the threats-and-safeguards analysis more rigorously across attest and nonaudit work.
Read the two as additive. Meeting the AICPA Code alone does not satisfy GAGAS.
Return to the trial-balance question from the top. An engagement manager needs to confirm whether preparing a client's financial statements creates a self-review threat. They also need to know how the GAGAS answer lines up with the AICPA Code.
This is a cross-authority question, and it is the kind Bizora Audit Research is built for. Bizora retrieves the governing GAGAS paragraph (3.88), traces the language back to the 2024 revision, and flags where the AICPA Code overlaps or diverges, with every answer cited to a specific standard and paragraph so the reasoning is ready for your file and for peer review before you rely on it.
The tool does not decide the question; it finds and cites the guidance and shows how the authorities relate. The independence conclusion is yours, the practitioner whose name goes on the report. That is the honest line: Bizora amplifies judgment, it does not make the call for you.
Research GAGAS independence and CPE questions at bizora.ai, then document the conclusion you reach and the safeguards you applied.
The following authorities inform this article:
For fiscal years beginning on or after October 1, 2024, GAGAS applies to auditors of nonprofits that expend $1,000,000 or more in federal awards and are subject to a single audit under 2 CFR 200. Earlier periods may be subject to the prior $750,000 threshold. GAGAS governs the auditor's work, not the nonprofit as an organization.
GAAS refers to the AICPA's Statements on Auditing Standards. For financial audits performed under GAGAS, the Yellow Book incorporates GAAS by reference and adds government-specific requirements on independence, CPE, reporting, quality management, and peer review.
Covered auditors generally must complete at least 80 hours of CPE every two years, including at least 24 hours in government-specific subjects. At least 20 hours must fall in each year, with no carryover between periods.
Preparing financial statements in their entirety from a client-prepared trial balance or underlying accounting records creates significant threats under GAGAS paragraph 3.88. The auditor must document the threats, the safeguards applied, and the conclusion that those safeguards reduce the threats to an acceptable level; if they don't, the auditor should decline the nonaudit service or the GAGAS engagement.
No, the Yellow Book and the Green Book differ. The Yellow Book is GAGAS (government auditing standards); the Green Book is the GAO's internal control standards, used alongside GAGAS.
Each audit organization conducting GAGAS engagements must obtain an external peer review by independent reviewers at least once every three years.
Bizora AI turns hours of manual research into seconds, with every answer backed by primary source citations. Start your 7-day free trial. No credit card required.
Start Free TrialRelated articles