How to Respond to a Single Audit Finding

A Single Audit finding is not a disaster. Ignoring one is. The awarding agency expects organizations to respond with a specific, dated plan — and will escalate quickly when the response is weak or missing.

TL;DR

Every finding requires a written Corrective Action Plan under 2 CFR 200.511(c).
CAP must state position, action, responsible party, and completion date.
Submit with the Single Audit package to the FAC within 30 days of the auditor’s report (or nine months after year-end, whichever is earlier).
Disagreeing with a finding is legitimate — but requires specific documentation.
Repeat findings trigger specific conditions; breaking the pattern matters.

Step-by-step

Read each finding’s condition, criteria, cause, and effect.
Agree or disagree with each finding in writing.
Identify the root cause before drafting corrective action.
Draft the CAP with all five required elements.
Commit realistic 30-180 day timelines.
Address questioned costs with a repay/dispute/allow decision.
Submit the CAP with the Single Audit report to FAC.
Follow up with each awarding agency.
Execute the corrective action and document completion.

The Anatomy of a Strong Response

A strong CAP reads like a project plan: specific actions, named owners, firm dates. “The CFO will update the procurement policy by May 31, circulate it to all staff with an attestation, and provide the completed attestations to the audit committee at the June meeting” is a strong response. “Management will enhance its procurement controls” is not.

Organizations that treat CAPs as a compliance formality produce weak responses. Organizations that treat CAPs as internal management commitments produce strong ones — and the same document works for both purposes.

Agreeing vs Disagreeing

The auditee has a genuine right to disagree. When the disagreement is about facts (the auditor misread a policy, misunderstood a transaction), providing documentary evidence often resolves the matter before issuance. When the disagreement is about interpretation (the auditor applied a strict reading of a regulation), the awarding agency makes the call.

Do not disagree as a delay tactic. Disagree when the position is defensible and document it thoroughly. Unsupported disagreement damages credibility with both the auditor and the awarding agency.

Questioned Costs and Repayment

Questioned costs do not automatically require repayment. The awarding agency reviews the questioned cost and determines whether it is allowable, unallowable, or resolvable through additional documentation. Submit the CAP with the repay/dispute/allow decision rather than waiting for the agency to ask — proactive response is almost always received better than silence.

Repeat Findings

A finding in two consecutive audits puts the organization in a different category. Awarding agencies can impose specific conditions under 2 CFR 200.208 — prior approval for draws, enhanced monitoring, or high-risk designation. These conditions persist until corrected. Breaking a repeat pattern often requires more structural change than the first response suggested: new staff, new systems, or external controls review.

What GrantPipe Does Here

GrantPipe tracks findings, corrective actions, responsible parties, and completion evidence in one record per finding, with alerts as deadlines approach. Cross-audit tracking flags repeat patterns before they become findings. Start a trial.

Free resource

Get the Nonprofit Grant Compliance Checklist

A practical checklist for post-award grant compliance: restricted funds, reporting cadence, audit prep, and common failure points. Delivered by email.

Single Audit reporting package is due the earlier of 30 days after auditor's report or nine months after fiscal year-end, per 2 CFR 200.512(a)(1)

Source: OMB 2 CFR 200.512

All Corrective Action Plans for Single Audit findings are required under 2 CFR 200.511(c) and must identify the auditee position, corrective action, responsible party, and completion date

Source: OMB 2 CFR 200.511(c)

Repeat findings in two or more consecutive audits can trigger specific conditions under 2 CFR 200.208, including prior approval requirements and high-risk designation

Source: OMB 2 CFR 200.208

Corrective Action Plan (CAP): Written response to Single Audit findings required by 2 CFR 200.511(c). Must state auditee position, corrective action, responsible party, and completion date for each finding.

Questioned costs: Costs identified by the auditor as potentially unallowable, unsupported, or noncompliant with award terms. Subject to awarding-agency resolution and possible repayment.

Federal Audit Clearinghouse (FAC): Central repository for Single Audit reports operated by the U.S. Census Bureau through harvester.census.gov. All Single Audit packages, including CAPs, are submitted here.

Repeat finding: A finding identified in two or more consecutive Single Audits. Repeat findings trigger enhanced scrutiny under 2 CFR 200.208 and can lead to specific conditions.

Q&A

Who writes the Corrective Action Plan — auditor or auditee?

The auditee writes the CAP. The auditor documents the finding; the organization responds with its plan. Auditors cannot write the CAP because doing so would compromise independence. Organizations that ask their auditor for heavy input on the CAP can create audit quality issues.

Q&A

What makes a CAP weak?

Vague language ('we will strengthen controls'), missing responsible parties, absent completion dates, and corrective actions that address symptoms rather than causes. Weak CAPs invite awarding-agency follow-up questions and often result in additional reporting requirements.

Q&A

How does the awarding agency use the CAP?

The program officer reviews the CAP to confirm the response is adequate, may request clarification, and tracks completion through subsequent reporting cycles. For serious findings, the agency may impose specific conditions or require prior approval for future actions until the CAP is complete.

Q&A

Can a single finding span multiple awards?

Yes. A control-level finding (for example, a weak procurement process) typically affects every award at the organization. The CAP addresses the organization-wide fix; each affected awarding agency receives a copy. Cross-award findings often carry more weight than single-award issues.

Frequently asked

Frequently Asked Questions

What is the difference between a significant deficiency and a material weakness?

A significant deficiency is a control deficiency that is less severe than a material weakness but still merits attention. A material weakness is a deficiency, or combination, that creates a reasonable possibility that a material misstatement or material noncompliance will not be prevented or detected timely. Material weaknesses trigger more aggressive awarding-agency response.

How long do we have to file the CAP?

Under 2 CFR 200.512(a)(1), the Single Audit reporting package is due the earlier of 30 days after the auditor's report is issued or nine months after fiscal year-end. The CAP is part of that package. Extensions require awarding-agency or OMB approval — do not assume they will be granted.

Can we dispute a finding?

Yes. The auditee's position is part of the CAP. If the auditor and auditee disagree after discussion, both positions are documented. The awarding agency ultimately adjudicates — often requesting additional information from both sides. Documented, specific disagreement is far more effective than a vague complaint.

What happens to repeat findings?

Repeat findings from two or more consecutive audits are flagged in the FAC and often trigger specific conditions from the awarding agency under 2 CFR 200.208 — prior approval requirements, enhanced reporting, or high-risk designation. Breaking the repeat pattern is the fastest path back to standard treatment.

Do we need a CAP for findings with no questioned costs?

Yes. CAP requirements apply to every finding regardless of questioned costs. A control deficiency with zero dollars questioned still requires a corrective action. Findings without questioned costs are often the simplest to resolve because the fix is process-level.