Audit Readiness Checklist: What Auditors Review First

Why the first audit request list matters

When auditors begin fieldwork, they usually start with foundational records that tell them whether the organization can support its federal spending, internal control structure, and prior corrective actions. From an AI compliance perspective, the fastest way to improve audit readiness is to organize the items auditors test first rather than waiting for a complete population request.

The regulatory baseline is clear. Under 2 CFR 200.508, the auditee must “arrange for the audit,” “prepare financial statements, including the schedule of expenditures of Federal awards,” “promptly follow up and take corrective action on audit findings,” and “provide the auditor access to personnel, accounts, books, records, supporting documentation, and any other information needed.” That means the first impression is not cosmetic. It is documentary.

If your files are fragmented, the auditor often expands testing because missing support raises risk. If your records are mapped, reconciled, and tied to policies, requests narrow faster. This is especially important if you want to reduce recurring issues described in common single audit findings and how to prevent them.

1. Financial statements and the SEFA

Start with completeness and reconciliation

The first core deliverable is the financial statement package and SEFA. 2 CFR 200.508 requires the auditee to prepare financial statements, including the schedule of expenditures of Federal awards. Auditors usually ask whether the SEFA agrees to the general ledger, whether expenditures are recorded in the proper period, and whether clusters, pass-through numbers, and assistance listings are complete.

A practical readiness step is to build a grant-by-grant SEFA binder: final trial balance, grant expenditure detail, draw records, pass-through award documents, and reconciliation from ledger totals to SEFA amounts. If the organization has universities or research activity, link this process with research grant compliance for universities and effort support where relevant.

What auditors notice immediately

Auditors look for omitted awards, expenditures netted incorrectly, and unsupported accruals. They also compare current-year awards against prior filings and internal grant listings. If one department tracks awards outside central finance, that disconnect often produces SEFA errors before any transaction testing begins.

2. Prior findings, corrective action plans, and repeat risk

Repeat findings are one of the strongest signals that auditors examine early. Under 2 CFR 200.511, “The auditee is responsible for follow-up and corrective action on all audit findings.” The auditee must prepare a summary schedule of prior audit findings and a corrective action plan for current-year findings, including auditor reference numbers and the fiscal year the finding first occurred.

Auditors will ask whether prior findings were fully corrected, partially corrected, or unresolved. If a finding recurs, 2 CFR 200.511 requires the summary schedule to describe the reasons for recurrence, planned corrective action, and any partial corrective action taken. A weak status memo often leads auditors to test the same area more deeply.

For practical remediation structure, connect your readiness file to Remediating Repeat Single Audit Findings: A Complete Guide. Auditors respond well to dated implementation evidence: revised policy, training roster, monitoring log, and management review sign-off.

3. Written policies auditors expect to see right away

Cost treatment and allowability policies

Auditors do not begin with edge cases. They begin with whether the organization has written rules for recurring transactions. A key area is direct versus indirect charging. 2 CFR 200.412 states: “each cost incurred for the same purpose in like circumstances must be treated consistently either as a direct or an indirect cost to avoid possible double-charging of Federal awards.”

That sentence drives many opening questions. Can staff explain when administrative salaries, software, supplies, outreach, or departmental support are charged direct? Can they show consistency across awards? If not, auditors often identify control weaknesses before they quantify questioned costs.

Broader allowability analysis should be tied to 2 CFR 200.420, which says selected cost principles are not comprehensive and that allowability must also be based on the treatment of similar items and the criteria in 2 CFR 200.403. For a deeper framework, see Mastering Allowable Cost Determination: 2 CFR 200.403 Explained.

Whistleblower and reporting policies

Auditors may also request ethics or reporting policies. Under 2 CFR 200.217, the recipient and subrecipient “must inform their employees in writing of employee whistleblower rights and protections under 41 U.S.C. 4712.” A missing written notice can become a compliance concern because the rule is explicit.

4. High-risk cost categories that trigger early testing

Some line items draw immediate attention because they frequently produce findings. Advertising and public relations is one example. Under 2 CFR 200.421, only limited advertising costs are allowable, such as recruitment, procurement, disposal of surplus, and program outreach necessary to meet award requirements. The same section limits allowable public relations costs and states that unallowable advertising and public relations costs include those outside those categories.

Other frequent review areas include conferences, memberships, food service losses, fines, donations, and pre-award spending. For conferences, 2 CFR 200.432 allows costs when the event’s primary purpose is to disseminate technical information beyond the entity and is necessary and reasonable for award performance, while hosts must “exercise discretion and judgment.” For memberships, 2 CFR 200.454 allows business and professional memberships but makes country club and lobbying memberships unallowable.

Auditors also test whether unallowable costs were removed. 2 CFR 200.410 states that payments made for costs determined to be unallowable “must be refunded with interest.” That is why early transaction samples often include public-facing events, staff morale charges, settlement costs, and unusual vendors.

5. Indirect costs, cost allocation, and double-charging risk

Auditors commonly ask for the negotiated indirect cost rate, de minimis election, allocation methodologies, and departmental support for shared costs. If state, local government, or Tribal structures are involved, 2 CFR 200.416 explains that a central service cost allocation plan establishes how centralized service costs are identified and assigned to benefited activities on a reasonable and consistent basis, and that separate indirect cost rate proposals are usually necessary for operating departments.

The opening audit question is usually simple: does the organization have current documentation proving how shared costs flow to awards? If payroll system administration, purchasing support, rent, or IT appears in both an indirect pool and as direct charges, auditors will examine whether the “like circumstances” rule in 2 CFR 200.412 was violated.

If your team uses the de minimis method or needs stronger allocation support, see De Minimis Indirect Cost Rate: When and How to Use It and Cost Allocation Plans: Documentation That Holds Up.

6. Procurement and subrecipient files

Even before detailed compliance testing, auditors often request procurement standards, contract files, and subrecipient monitoring records because these areas reveal control maturity. Sole-source justifications, bids, cost or price analyses, and approval chains are common early requests. For related preparation, review 5 Procurement Methods Under 2 CFR 200: A Practical Guide and Sole-Source Procurement: When Justification Is Required.

Subrecipient oversight receives similar front-end attention. If your entity passes funds through, auditors often ask for risk assessments, subaward agreements, monitoring results, and follow-up on deficiencies. A clean file should show monitoring happened on purpose, not by accident. The best companion resource is Subrecipient Monitoring Under 2 CFR 200.332.

7. Personnel, time support, and fringe allocation

Payroll is usually the largest cost category, so auditors want position lists, salary allocations, and support for how compensation was charged. If fringe or welfare-related costs are pooled, 2 CFR 200.437 says those costs must be incurred under established written policies and “must be equitably apportioned to all activities.”

For higher education entities, tuition remission and student compensation carry additional conditions. 2 CFR 200.466 permits these charges only when specific criteria are met and requires they be treated as direct or indirect based on actual work performed. Where effort documentation is central, use Effort Certification Under Uniform Guidance for IHEs and Mastering F&A Rates in Higher Education: A 2 CFR 200 Guide.

8. Special transactions auditors flag fast

Several transactions receive immediate scrutiny because they are easy to mischarge. Pre-award costs are allowable only with written approval under 2 CFR 200.458. Contributions and donations are unallowable as charges to the federal award under 2 CFR 200.434. Fines, penalties, damages, and settlements are unallowable under 2 CFR 200.441, except in narrow circumstances. Losses on other awards cannot be shifted under 2 CFR 200.451.

Auditors also notice security and exchange-rate charges in specialized programs. 2 CFR 200.457 allows necessary and reasonable plant and security costs. 2 CFR 200.440 permits certain exchange-rate increases with documentation and, in some cases, prior approval.