8 Nonprofit Audit Preparation Mistakes That Turn a Clean Audit Into a Finding

Between 30 and 40 percent of Single Audit findings in the Federal Audit Clearinghouse database are repeat findings — the same organization with the same finding in consecutive audit cycles. An incomplete PBC list is the single most controllable cause of audit timeline extensions and unplanned audit costs. The eight mistakes below either produce first-time findings or are the specific practices that convert first-time findings into repeat findings.

Mistake 1: Starting Audit Preparation the Month Before Fieldwork

The mistake: The finance director begins assembling audit documentation — pulling grant files, preparing account reconciliations, reviewing the prior year management letter — 30 days before scheduled fieldwork. The organization treats audit preparation as a discrete pre-fieldwork task rather than a year-round practice.

Why it happens: Audit preparation is perceived as a finite deliverable rather than a continuous documentation discipline. The finance team is managing daily operations; audit prep competes with that work and gets deferred until the deadline forces it.

The consequence: Thirty days is not enough time to surface and resolve documentation gaps. If the prior year finding on restricted fund documentation was never formally remediated, a 30-day window cannot produce the year of documentation needed to demonstrate corrective action. If a grant award was amended and the amendment was never filed in the grant record, the auditor will find it before you do.

The fix: Start the audit preparation calendar 90 days before scheduled fieldwork. At 90 days: confirm fieldwork dates, pull the prior year management letter, and assign corrective action owners to open items. At 60 days: begin compiling the PBC list, verify all grant files are complete, and reconcile restricted fund balances. At 30 days: submit the initial PBC batch, address documentation gaps, and confirm staff availability. The 90-day timeline converts audit preparation from crisis management to a predictable process.

Mistake 2: Restricted Fund Documentation Assembled After the Fact

The mistake: Restricted fund documentation — grant award agreements, expense reports, approved budget modifications, time records supporting personnel allocations, and narrative progress reports — is assembled from scattered sources in the weeks before the audit, rather than maintained in a complete grant file throughout the award period.

Why it happens: Documentation maintenance is treated as a pre-audit task rather than an award administration responsibility. Receipts are in email. Budget modifications are in a shared drive folder with no index. Time records were submitted to HR but never copied to the grant file. The grants manager assembles the complete record on demand rather than maintaining it continuously.

The consequence: Documentation assembled after the fact is incomplete. Auditors distinguish a grant file maintained throughout the award period — documents dated contemporaneously with the activities they document — from a file assembled in November containing documents from March with no clear record of when they were filed. Post-hoc assembly raises questions about whether documentation was created contemporaneously or reconstructed. Time-and-effort records that cannot be shown to be contemporaneous with the pay periods they cover are at risk of being found inadequate.

The fix: Maintain a grant file for each active award with required contents and a quarterly filing discipline. Required contents: the original award letter and amendments, approved budget, all program officer correspondence, all submitted reports with acknowledgment of receipt, expenditure documentation, and time records for personnel charged to the award. Review and update each grant file quarterly, not at audit time.

Mistake 3: No Reconciliation Between Grants Management Records and the General Ledger

The mistake: The grants management system (or grant tracking spreadsheet) and the accounting system contain separate records of each grant’s expenditures and fund balance, and the two records are never formally reconciled. Discrepancies between the two systems are discovered during audit fieldwork rather than during regular operations.

Why it happens: The grants management system and the accounting system are maintained by different staff — grants management is the grants manager’s domain, accounting is the finance team’s domain — and there is no regular reconciliation process that connects the two.

The consequence: When an auditor asks for a reconciliation between grant management records and the general ledger, the organization cannot produce one. The auditor reconciles them independently and identifies $12,000 in expenditures in the accounting system but not in the grant management system — typically journal entry corrections made in accounting without a corresponding grant system update. This discrepancy produces a reporting finding and requires the organization to explain why the two records differ.

The fix: Perform a monthly reconciliation between the grant management system and the general ledger for each active award. Verify: total expenditures per the grant management system match the general ledger fund code balance, all general ledger transactions for the period are reflected in the grant management system, and the accounting fund balance matches the remaining award balance in the grant management system. Document the reconciliation and retain it in the grant file.

Mistake 4: Board Minutes Missing Key Approvals

The mistake: The board of directors takes actions — approving the executive director’s compensation, authorizing significant contracts, approving the annual budget, or ratifying major grants — verbally in board meetings, but these actions are not reflected in the board minutes with sufficient specificity to constitute an approval record.

Why it happens: Board minutes are prepared by the board secretary, who may not have a legal or accounting background, and are treated as a narrative summary of meeting discussion rather than as a formal record of governance decisions. Minutes are approved at the next board meeting, often months later, by board members who do not scrutinize them closely.

The consequence: Auditors reviewing executive compensation for Related Party transactions (FASB ASC 850 and Form 990 Schedule L) need to see a board-approved compensation amount in the minutes. Minutes that say “the board approved an increase” without specifying the dollar amount cannot verify compliance with independent compensation approval requirements. Missing or vague compensation approvals produce a governance finding. Missing authorization for significant contracts produces an internal controls finding.

The fix: Establish a board minutes template with specific approval language for each required action category: executive compensation (name, effective date, dollar amount or percentage increase), significant contracts (vendor, purpose, dollar amount, term), annual budget (fiscal year totals, restricted fund transfers), and grant acceptance above a threshold (funder, award amount, compliance obligations). Have your CPA or auditor review one year of minutes before the next audit to identify gaps.

Mistake 5: Prior Year Finding Remediation Not Documented in Writing

The mistake: The organization received an audit finding in the prior year — typically a deficiency in restricted fund documentation, time-and-effort records, or board minute specificity — and addressed it internally. New procedures were put in place. But the remediation was never documented in writing, and the organization cannot demonstrate to the current year’s auditor that the corrective action was implemented.

Why it happens: Verbal remediation is common: the executive director tells the finance manager to fix the process, and the new approach is followed informally. The corrective action plan submitted at the time of the finding may have described the intended fix, but no one documented that it was actually implemented.

The consequence: A prior year finding that cannot be demonstrated as remediated becomes a repeat finding. Repeat findings carry escalated consequences — they appear in the Single Audit Clearinghouse as persistent deficiencies, affect the organization’s risk profile for federal funding, and signal that internal controls are not improving. Federal Audit Clearinghouse data shows 30–40% of findings are repeats; verbal remediation is a primary driver.

The fix: For every finding or management letter comment, create a written remediation record documenting: the corrective action taken, the date implemented, the responsible staff member, and evidence the new procedure is being followed (sample compliant documentation, signed policy acknowledgment, or training record). Retain it in the audit file. Test the new procedure before fieldwork by pulling a sample under the corrected process and confirming it meets the standard the finding identified.

Mistake 6: PBC List Incomplete When Fieldwork Begins

The mistake: The auditor delivers the PBC list four to six weeks before fieldwork. The organization begins assembling the requested documents but does not complete the list by the fieldwork start date. When the audit team arrives, they discover 20–30% of the requested items are missing or incomplete.

Why it happens: The PBC list is distributed to the finance team, which delegates items to program staff, HR, and the executive director. Each person treats the request as one of many competing priorities. There is no internal owner tracking completion. Items that require coordination across departments — restricted fund schedules requiring both accounting and grants management data — fall through the gaps.

The consequence: An incomplete PBC list when fieldwork begins requires the auditor to pause while items are assembled (extending the timeline and adding billing hours) or return for missing items later. Audit extensions from incomplete PBC lists cost organizations $500–$3,000 in additional fees on average, plus staff time and a disrupted close schedule.

The fix: Assign a PBC owner — the finance director or controller — responsible for tracking every item from receipt to completion. When the PBC list arrives, enter each item with the description, responsible staff member, internal due date (five business days before fieldwork), and status. Send weekly updates. Any item that will miss the internal due date should trigger an immediate conversation with the auditor — flagging a delay early is far better than handing over an incomplete list on fieldwork day one.

Mistake 7: No Internal Controls Review Before External Auditors Arrive

The mistake: The organization does not conduct an internal review of its key controls — segregation of duties, authorization procedures for disbursements, physical safeguards for assets, reconciliation procedures — before external auditors assess those controls during fieldwork.

Why it happens: Internal controls review is perceived as the auditor’s job. The organization believes that if the auditor identifies a control weakness, they will note it in the management letter and the organization will address it. The notion that the organization should identify and remediate control weaknesses before the audit is not part of the standard preparation process.

The consequence: Control weaknesses identified by the auditor for the first time during fieldwork appear in the management letter or, if material, in the formal findings. They do not have to. A weakness that is remediated before fieldwork begins does not appear in the audit report. Waiting for the auditor to find it means waiting for a public record of the deficiency. For organizations with federal awards, a material weakness can trigger enhanced funder oversight and affect award renewals.

The fix: Ninety days before fieldwork, conduct a self-assessment against the five COSO internal control components: control environment (tone, ethics policies), risk assessment (key financial risks), control activities (authorization procedures, segregation of duties, reconciliations), information and communication (reporting timeliness), and monitoring (management review). Identify gaps and remediate them before fieldwork. Document the self-assessment to demonstrate to the auditor that control gaps were identified and addressed proactively.

Mistake 8: Management Response to Findings Written Defensively Rather Than Remedially

The mistake: When the auditor issues a draft audit report with findings, the organization’s management response focuses on explaining why the finding is not as serious as characterized, disputing the auditor’s interpretation, or providing context that implies the finding was unfair. The response does not commit to specific corrective actions or timelines.

Why it happens: Findings feel like accusations. The finance director is defensive because the finding reflects on their stewardship. The executive director is concerned about the funder relationship implications. The natural response is to defend the organization’s position rather than to accept the finding and commit to correction.

The consequence: A defensive management response does not eliminate the finding. What it does accomplish: it tells the funder, oversight agency, and next year’s auditor that the organization lacks a clear corrective action plan. The 30–40% repeat finding rate in the Federal Audit Clearinghouse reflects, in part, management responses that committed to vague future improvement rather than specific dated actions.

The fix: Write the management response to answer three questions: what specifically went wrong, what specific action has been or will be taken, and by what date? Keep it brief, factual, and forward-looking. If the organization disagrees with the finding’s characterization, note it in one sentence and proceed to the corrective action. A response with a clear corrective action timeline is the most effective tool for preventing a repeat finding — it sets a documented standard the next year’s auditor will test.