How to qualify as a low-risk auditee
You must meet all five criteria in 2 CFR 200.520 for each of the two preceding audit periods. The payoff is coverage: major programs need reach only 20 percent of federal awards expended instead of 40 percent (200.518(f)). In audit year 2024, 13,812 of 22,398 nonprofit single audits (61.7%) recorded low-risk auditee status (data as of 2026-09-20).
Last verified: 2026-09-20 · Every figure links its source.
What are the criteria for a low-risk auditee?
| Criterion | What it requires |
|---|---|
| Audits performed and filed on time | Single audits performed annually under subpart F, with the data collection form and reporting package submitted to the FAC within the required timeframe |
| Unmodified opinions | An unmodified opinion on whether the financial statements were prepared under GAAP (or a required special purpose framework) and an unmodified in-relation-to opinion on the schedule of expenditures of federal awards |
| No material weaknesses | No internal control deficiencies identified as material weaknesses under GAGAS |
| No going-concern doubt | The auditor did not report substantial doubt about the ability to continue as a going concern |
| No disqualifying program findings | No federal program had a material weakness in internal control, a modified opinion on the program, or questioned costs exceeding five percent of total federal awards expended for a Type A program |
Source: 2 CFR 200.520 · Last verified: 2026-09-20
Why does low-risk status matter?
It changes how much of your federal spending must be inside major programs. A low-risk auditee needs major programs covering at least 20 percent of total federal awards expended; everyone else needs at least 40 percent (2 CFR 200.518(f)). Fewer major programs means less compliance testing, fewer document requests and, usually, a lower fee. It also shapes the risk assessment the auditor performs on Type A and Type B programs.
Source: 2 CFR 200.518 · 2 CFR 200.519 · Last verified: 2026-09-20
Can a first-year single audit be low risk?
No. The criteria look back at the two preceding audit periods, so an organization filing its first single audit has no qualifying history. Plan the first two years on the assumption of 40 percent coverage, and treat the status as something you earn in year three by filing on time and clearing findings (2 CFR 200.520).
Source: 2 CFR 200.520 · Last verified: 2026-09-20
How do you keep it?
- Submit on time, every year — the first criterion is purely administrative and the easiest to lose.
- Clear material weaknesses before year end rather than explaining them afterwards.
- Write corrective action plans that actually close findings, so they do not repeat (2 CFR 200.511(c)).
- Watch questioned costs against the five percent test for Type A programs.
- Resolve going-concern issues with the auditor early; a going-concern paragraph removes the status even when everything else is clean.
Source: 2 CFR 200.520 · 2 CFR 200.511 · Last verified: 2026-09-20
Questions and answers
What is a low-risk auditee?
An auditee that met all five criteria in 2 CFR 200.520 for each of the two preceding audit periods, which lowers the share of federal awards expended that major programs must cover.
How many nonprofits qualify as low-risk auditees?
In audit year 2024, 13,812 of 22,398 nonprofit single audits in our copy of the Federal Audit Clearinghouse data recorded low-risk auditee status, or 61.7%.
Comparing audit fees after a finding? See what nonprofits pay.
This is public-record information, not accounting or legal advice.