TLDR
The SF-SAC dual-signature flow - auditee certifying officer signs first, then the auditor counter-signs separately - is the single most common reason single audits sit unfiled past the 30-day post-report deadline.
SF-SAC Data Collection Form: Single Audit Filing Guide
The single audit is complete when the auditor signs the reports. The filing is complete when the SF-SAC clears the Federal Audit Clearinghouse. Those two events are not the same, and the gap between them is where organizations miss the 30-day deadline.
The SF-SAC is a two-party process - auditee certifies, auditor counter-certifies, in that order. Both parties need FAC accounts. Both parties must act within the 30-day window. Most missed deadlines occur because the auditee submitted their portion and waited, assuming the auditor would handle the rest automatically.
The 30-Day Filing Window
Under 2 CFR 200.512, the submission deadline is the earlier of:
- 30 days after the auditor’s report date, or
- 9 months after the fiscal year end
For a December 31 fiscal year end with an audit report dated April 15, the deadline is May 15.
For a June 30 fiscal year end with a report dated February 28, the 30-day deadline (March 30) is earlier than 9 months (March 31) - both land in the same window but the 30-day rule controls.
The FAC timestamp records when the submission is fully complete - both signatures in place. The auditee signing on day 28 and the auditor signing on day 33 means the submission is late.
What the SF-SAC Contains
The SF-SAC is a data collection form, not the audit itself. It summarizes:
| Section | What it captures |
|---|---|
| General information | Organization EIN, UEI, fiscal year, audit type |
| Financial statements | Audit opinions, going concern disclosures, financial statements |
| Federal awards | Each ALN, program name, expenditures, major program status |
| Findings | Finding numbers, types, questioned costs, repeat findings |
| Auditee certification | Certifying official’s attestation |
| Auditor certification | Auditor’s attestation |
All of these data points must be consistent with the uploaded reporting package documents. FAC does limited automated validation, but inconsistencies between the SF-SAC data and the uploaded reports create issues when oversight agencies review submissions.
FAC Account Requirements
The transition to fac.gov in 2023 (from the prior Census-run system) introduced Login.gov as the authentication mechanism. Key requirements:
Auditee: The certifying official must have a Login.gov account. For organizations submitting their first single audit, allow 3-5 business days for identity verification. The certifying official must be authorized by the organization - FAC requires a separate auditee authorization.
Auditor: The audit firm must be registered in FAC as an audit firm, and the individual CPA certifying must have a Login.gov account linked to that firm. Many audit firms pre-register during audit planning; confirm this well before the 30-day window opens.
Common Errors That Delay Acceptance
-
Mismatched report dates: The date entered in FAC must match the date on the signed audit report. A one-day discrepancy triggers rejection.
-
Password-protected PDFs: FAC requires accessible PDFs. Password-protected or encrypted documents fail upload validation.
-
Inconsistent finding numbers: Finding reference numbers in the SF-SAC data entry must match the numbering in the uploaded schedule of findings exactly. “2026-001” in the data and “Finding 1” in the document fails.
-
Missing corrective action plan: Every finding requires a corresponding corrective action plan entry. A finding without a CAP prevents submission completion.
-
Auditor delay: The auditor receives an email invitation to certify after the auditee signs. If the auditor does not act within the window, the submission stalls. Coordinate timing explicitly - confirm the auditor’s certification date before the auditee signs.
How GrantPipe Helps
GrantPipe’s audit preparation module keeps the SEFA data current throughout the year, which means the federal awards data entered into FAC can be extracted directly from the system rather than assembled from spreadsheets at year-end. The corrective action plan tracking in GrantPipe ensures each finding gets a structured response with owner and due date - the same format the SF-SAC requires - rather than a narrative memo drafted under deadline pressure.
Free resource
Get the Nonprofit Grant Compliance Checklist
A practical checklist for post-award grant compliance: restricted funds, reporting cadence, audit prep, and common failure points. Delivered by email.
- SF-SAC
- Standard Form - Single Audit Collection. The official data collection form submitted to the Federal Audit Clearinghouse to complete the single audit reporting requirement. Contains audit summary data, findings, and financial statement information.
DEFINITION
- Federal Audit Clearinghouse (FAC)
- The federal repository for single audit submissions, now operated by GSA. Publicly accessible at fac.gov. All single audit submissions are publicly searchable.
DEFINITION
- Auditee certifying official
- The individual authorized to sign the auditee section of the SF-SAC on behalf of the organization - typically the executive director or chief financial officer. Must have a Login.gov account linked to the FAC.
DEFINITION
- Corrective action plan (CAP)
- The auditee's written response to audit findings, required under 2 CFR 200.511(c). Must include: the finding number, nature of the finding, planned corrective actions, responsible person, and expected completion date. The CAP is uploaded as part of the SF-SAC reporting package.
DEFINITION
- Schedule of findings and questioned costs
- The auditor's document listing all findings from the single audit, organized by financial statement findings, findings on internal control, and compliance findings. Questioned costs are identified separately.
DEFINITION
Q&A
How does the dual-signature process work?
The SF-SAC submission requires two separate authenticated sign-offs. First, the auditee creates the submission in FAC, enters all required data, and the certifying official electronically signs the auditee certification. Then the auditor independently logs into FAC, reviews the auditee-submitted data, and certifies the auditor section. The submission is not complete - and FAC will not accept it - until both parties have signed. This is the primary source of deadline misses: organizations submit the auditee portion and wait for the auditor, not realizing the auditor must separately log in and act.
Q&A
What is included in the reporting package upload?
The complete package is uploaded as PDFs: the audited financial statements with notes, the SEFA, the auditor's report on the financial statements, the report on internal control over financial reporting and on compliance with federal requirements (the Yellow Book/GAGAS report), the schedule of findings and questioned costs, and the corrective action plan. All documents must be uploaded before the submission is marked complete.
Q&A
What if there are errors in the SF-SAC after submission?
FAC allows amendments to accepted submissions. The auditee must reopen the submission, correct the data, re-certify, and have the auditor re-certify. The original submission date is preserved in FAC's public record, but the amendment date is also noted. Frequent amendment cycles are visible to oversight agencies.
Frequently asked