What happens if a nonprofit misses its single audit deadline?

In short: The package is due 30 days after the auditor's report is received or nine months after the audit period ends, whichever is earlier (2 CFR 200.512). Where an audit is not done, the federal agency or pass-through entity may use the remedies in 2 CFR 200.339, from specific conditions to withholding payments or further funds.

When is a single audit due?

The audit, the data collection form and the reporting package must be submitted within 30 calendar days after the auditee receives the auditor's report, or nine months after the end of the audit period, whichever is earlier (2 CFR 200.512(a)).

The reporting package consists of the financial statements and the schedule of expenditures of federal awards, the summary schedule of prior audit findings, the auditor's reports and the corrective action plan (2 CFR 200.512(c)). For worked examples by fiscal year end, see the deadline and extensions guide, or enter your year end in the single audit deadline tool.

Source: 2 CFR 200.512 · Last verified: 2026-11-15

What can a federal agency or pass-through entity do when an audit is missing?

The audit rules say that in cases of continued inability or unwillingness to have an audit conducted as required, federal agencies or pass-through entities must take appropriate action as provided in 2 CFR 200.339 (2 CFR 200.505). That section lets them act, and does not set a fixed penalty.

First, they may implement specific conditions on the award. When they determine that the noncompliance cannot be remedied by specific conditions, they may take one or more of these actions, listed here in the rule's order:

• (a) Temporarily withhold payments until the recipient or subrecipient takes corrective action.
• (b) Disallow costs for all or part of the activity associated with the noncompliance.
• (c) Suspend or terminate the federal award in part or in its entirety.
• (d) Initiate suspension or debarment proceedings under 2 CFR part 180, or, for a pass-through entity, recommend that the federal agency initiate them.
• (e) Withhold further federal funds, meaning new awards or continuation funding, for the project or program.
• (f) Pursue other legally available remedies.

A pass-through entity must also verify that each subrecipient is audited as the audit rules require, and it is told to consider enforcement action against a noncompliant subrecipient (2 CFR 200.332(g) and (i)). The FAC, for its part, is required to follow up with known auditees that have not submitted a data collection form and reporting package (2 CFR 200.512(g)). Which action applies, if any, is the decision of the agency or pass-through entity that funds you, so the answer for your organization comes from your award terms and that funder. This is not legal advice.

Source: 2 CFR 200.505 · 2 CFR 200.339 · 2 CFR 200.332 · 2 CFR 200.512 · Last verified: 2026-11-15

Does filing after the due date affect low-risk auditee status?

It can. One of the conditions for low-risk auditee status is that the data collection form and reporting package were submitted within the timeframe in 200.512 for each of the preceding two audit periods (2 CFR 200.520(a)). A submission after the due date therefore means the auditee does not meet that condition while that audit period is one of the two preceding ones.

That table is the percentage of coverage rule in 2 CFR 200.518(f). The other low-risk conditions are annual single audits, unmodified opinions, no material weaknesses, no going-concern doubt and clean Type A programs. See how to qualify as a low-risk auditee.

Source: 2 CFR 200.520 · 2 CFR 200.518 · Last verified: 2026-11-15

How often is a single audit accepted after the nine-month date?

4,764 of 21,424 nonprofit single audits accepted by the FAC in 2025 (22.2%) were accepted more than nine months after the fiscal year ended. Data as of 2026-11-06, from our State of Single Audit 2025 report.

That is the date gap only. An extension from the cognizant or oversight agency, or a resubmission, can explain a gap, so the figure is not a count of organizations that missed their deadline. How we computed it: nonprofit auditees only, one report per organization and audit year, counted by the calendar year the FAC accepted the filing.

Source: Federal Audit Clearinghouse · 2 CFR 200.512 · Last verified: 2026-11-15

The due date has already passed: what now?

The provisions cited above do not set out a procedure for a filing that has already missed its date. The steps below are our suggestions for a sensible order, not rule text.

1. Get the audit finished and the package filed with the FAC as soon as it is ready; the submission still has to be made electronically to the FAC.
2. Check whether an extension was available. Only the cognizant or oversight agency for audit can authorize one, and the rule ties it to an undue burden.
3. Tell each awarding agency and pass-through entity that funds you where the audit stands, in writing, before they ask. They are the ones who decide whether to use a 200.339 remedy.
4. Keep a dated record of the cause, the plan and the filing, and keep the FAC submission confirmation with the audit file; the rule requires you to keep the data collection form and reporting package for three years from the date of submission.
5. If an agency has already written to you about the missing audit, answer that letter and consider advice from counsel.

Nothing here is legal advice, and the consequence for your organization depends on your award terms.

Source: 2 CFR 200.512 · 2 CFR 200.339 · Last verified: 2026-11-15

Questions and answers

This is public-record information, not accounting or legal advice.