The situation
This is an illustrative scenario. It is a composite built from patterns common in this kind of work and does not describe any real client.
A community health nonprofit runs two small clinics, a mobile outreach van and a community health worker program in a largely rural county. It has about 85 staff and an annual budget near $9 million, most of it from patient revenue, foundation grants and a state contract. The finance team is a finance director, a staff accountant and a part-time grants manager. The books are in QuickBooks Online, with a class for each program and a spreadsheet for each grant. Payroll runs through an outside provider, and staff record their hours in a separate timekeeping app.
Federal money had always been a modest share of the budget: a direct award from the Department of Health and Human Services for the community health worker program, and two federal pass-through awards from the state health department and the county. Federal expenditures had hovered around $700,000 a year. That was below the threshold that applied at the time, and well below the $1,000,000 threshold the 2024 Uniform Guidance set for fiscal years beginning on or after 1 October 2024.
Then the organization won a new three-year federal award to integrate behavioral health into its clinics. The finance director projected federal expenditures of about $1.4 million in the coming fiscal year, which meant a first single audit. The executive director and the board treasurer asked the obvious question: what does that audit look for, and are we ready?
What we did
The work began as a four-week diagnostic under our Grant & Uniform Guidance Compliance service. The engagement lead and a controls specialist traced each federal award from the notice of award to the ledger: how costs were coded, who approved them, how drawdowns and reimbursement requests were prepared, and what each award's terms required.
A forensic data analyst ran eighteen months of grant-coded transactions through tests built for federal awards. The tests looked for costs dated outside each award's period of performance, accounts that usually hold unallowable costs, purchases above the informal bid limit, vendors whose address or bank account matched a staff or board member, and payroll charges that differed from recorded hours.
The specialists then walked one real transaction through each process with the person who handles it: a nurse coordinator's salary charged to the HHS award, a laptop purchase, a payment to a partner organization and a quarterly reimbursement request to the state.
The board then approved a twelve-week project: six written policies, redesigned time-and-effort records, subrecipient monitoring, a draft schedule of expenditures of federal awards, two training sessions and a mock single audit in the final three weeks.
What we found
The findings register ranked eleven items. Five carried most of the risk.
- Personnel charges followed the budget, not the work. Salaries were split across awards by percentages set at budget time and never updated. For 14 months the community health worker lead had been charged 60 percent to the HHS award, while the timekeeping app, which already recorded a program code for each shift, showed closer to 40 percent in most pay periods. Across 26 pay periods, about $31,400 had been charged to the federal award without records to support it.
- Two "contracts" were subawards. Agreements with a food bank and a youth center paid them to deliver part of the federal program. Under 2 CFR 200 that made them subrecipients and the nonprofit a pass-through entity. Neither agreement contained the required award information, no risk assessment existed, and nobody had asked for their audits.
- Procurement had no written procedure. A $62,000 telehealth platform contract had been awarded without documented competition. The vendor's owner was married to a board member who had never been asked to disclose the relationship, and the file did not show who made the decision. No one had checked the vendor against the SAM.gov exclusion list.
- Equipment was not tracked. The outreach van and a portable ultrasound unit, each above the $10,000 equipment threshold and bought partly with federal funds, did not appear on any property record.
- Small unallowable costs had reached federal awards. A $1,240 catering bill for a donor reception and a conference registration dated nine days after an award ended were charged to federal classes.
There was no sign that anyone had taken money. The problems were ones of documentation and design, built up by a capable team that had never been asked to meet these rules in full.
What changed
The finance director corrected the unsupported personnel charges, moving $31,400 from the HHS award to unrestricted funds, and discussed the correction with the program officer and the incoming auditor.
The board adopted six written policies: procurement, conflicts of interest, cost allowability, time and effort, equipment, and subrecipient monitoring. The procurement policy sets micro-purchase, quote and formal bid levels, requires a SAM.gov exclusion check before covered transactions, and requires a written conflict disclosure from anyone involved in a selection. The telehealth contract was competed again at renewal, with the board member recused and the recusal recorded in the minutes. Each policy follows the current 2024 text of 2 CFR 200 and notes which sections OMB's May 2026 proposal would change, because as of November 2026 that proposal is not final.
Time and effort changed most. Staff funded by more than one source now record hours by program code in the existing timekeeping app. Each month the staff accountant compares charges with recorded activity. Each quarter, any difference above a set tolerance is adjusted and documented, and each employee and supervisor confirm the record. The grants manager now owns a monthly reconciliation of the schedule of expenditures of federal awards to the ledger.
The food bank and the youth center received revised subaward agreements with the required award information, a documented risk assessment, quarterly desk reviews and a standing request for their latest audits. The van and the ultrasound unit were tagged and entered in a property register with funding source, location and condition.
Program directors attended two training sessions built on their own awards: which costs are allowable, what the period of performance means for a late invoice, and why their timesheets matter to the audit.
The mock single audit ran over the final three weeks. A controls specialist who had not worked on the policies selected the award most likely to be tested as a major program and worked through the compliance requirements an auditor would examine: allowable costs, period of performance, procurement and suspension and debarment, reporting, and subrecipient monitoring. Samples came from the first two months under the new process. Two gaps remained, a missing supervisor confirmation and a late subrecipient desk review, and both were closed before the auditor's fieldwork. A mock audit is a rehearsal. It is not an audit and gives no opinion.
The organization then selected its single auditor through its new procurement policy, as 2 CFR 200 requires.
What to take from it
A first single audit is mostly a test of records the organization should have been keeping all along. The useful work is making that evidence a by-product of daily operations: timesheets that carry program codes, a procurement file that builds itself as a purchase is made, a subrecipient checklist that runs every quarter.
If your federal funding is growing, the Single Audit Threshold Checker gives a general reading of where you stand, and the single audit readiness checklist lists what auditors usually ask for first. Start with personnel costs. They are usually the largest charge to a federal award and the hardest to support after the fact.