5 Signs Your Nonprofit May Be at Risk in an Audit

Audit Risk Isn't Random

Some audit findings are truly surprising. Most are not. After hundreds of nonprofit audit engagements, our team has identified a consistent set of risk factors that appear in organizations that encounter findings — and the good news is that most can be addressed before your auditor arrives. Here are five signs your nonprofit may be carrying more audit risk than it needs to.

1. Your General Ledger Doesn't Match Your Grant Reports

Grant reports submitted to funders should reconcile directly to your general ledger. When they don't — when the numbers reported to a grantor are derived from a spreadsheet, memory, or a different system than your accounting records — you have a documentation and reconciliation problem that auditors will almost certainly surface.

The fix: establish a formal reconciliation process that ties each grant report back to your GL before submission. This becomes your audit trail when the auditor asks how you determined the reported figures.

2. You Don't Have Written Policies for Key Financial Controls

Auditors evaluate your internal control environment — and that evaluation requires documented policies. Organizations without written policies for cash handling, expense approval, payroll authorization, grant drawdowns, and procurement face elevated risk of a finding on internal controls.

The fix: document your key financial control policies before audit season. They don't need to be elaborate — they need to be written, approved by leadership, and actually followed by your staff.

3. Functional Expense Allocation Lacks Documented Methodology

Nonprofit financial statements require expenses to be presented by both functional classification (program, management and general, fundraising) and natural classification (salaries, occupancy, supplies). The allocation of shared costs — particularly salaries and occupancy — to these categories requires a documented methodology. When that methodology lives only in someone's head or changes year to year without explanation, it creates audit risk.

4. Board-Approved Financial Statements Are Prepared After the Audit

Your board is responsible for the financial statements. But in many nonprofits, management presents only the audited financial statements to the board — after the auditor has already issued their opinion. This puts the auditor in the position of being the primary reviewer of financial information, rather than serving as an independent check on management-reviewed statements.

Organizations with strong governance present interim financial statements to the board regularly throughout the year. When annual audited statements are presented, the board has already been reviewing the underlying data for months.

5. You Have Unresolved Prior Audit Findings

Prior audit findings that appear in the Federal Audit Clearinghouse or in prior-year management letters signal to the current auditor that specific areas need closer attention. Unresolved prior findings are one of the primary risk factors used in major program determination for Single Audits — meaning unresolved findings make compliance testing more extensive and more likely to surface additional issues.

The fix: take all audit findings seriously in the year they are issued. Implement corrective actions promptly, document the resolution, and communicate progress to your auditor at the start of the next engagement. Demonstrating that findings have been genuinely resolved reduces risk in future years.