How long to keep records, and what triggers a Single Audit · 14 practice questions
0:00 / --:--
Reading
Fiscal Management is one of the four CGMS exam domains, and this course
groups two related topics under it: how long records have to be kept, and
when an organization crosses the line into needing a Single Audit. Both
rules exist for the same reason, a federal award's paper trail has to
survive long enough, and be complete enough, for someone to check the
government's money was spent as promised, potentially years after the
work itself is finished.
The basic record retention rule: three years
2 CFR 200.334 sets the baseline: a recipient or subrecipient must
retain all federal award records for three years from the date it
submits its final financial report. For an award with recurring
quarterly or annual reports rather than one final report, the clock
resets with each report, three years from the submission of each one.
Three years is a floor, not a ceiling, several situations extend it.
What extends the retention period beyond three years
If litigation, a claim, or an audit is started before the three-year
period expires, records must be kept until that matter is finally
resolved, however much longer than three years that takes. Records for
property or equipment purchased with federal funds must be kept for
three years after the property's final disposition, not three years from
the award's end. If an organization earns program income after its
period of performance ends, and the federal agency requires records of
it, those records are kept three years from the end of the fiscal year
in which that income was earned. And indirect cost rate proposals and
cost allocation plans have their own timeline depending on whether they
were actually submitted for negotiation. A federal agency, pass-through
entity, or cognizant agency for audit or indirect costs can also extend
the retention period further by notifying the organization in writing
(200.334(b)), for a pending review, for instance. Outside the exceptions
listed in 200.334, agencies and pass-through entities may not impose other
retention requirements, and the three-year requirement does not apply to
records that have been transferred to or are maintained by the federal
agency.
The Single Audit: what it is and who needs one
A Single Audit (governed by 2 CFR 200 Subpart F, sections 200.501 and
following) is an organization-wide audit of a non-federal entity that
expends federal awards at or above a certain dollar threshold in its fiscal
year, covering both its financial statements and its compliance with
federal award requirements, in place of doing a separate audit for every
individual federal program. It replaces what would otherwise be a
patchwork of program-specific federal audits with one audit covering
everything, hence "single."
The threshold, and a number that changed recently
Under the 2024 revision to the Uniform Guidance, effective for fiscal
years beginning on or after October 1, 2024, the Single Audit threshold
is $1,000,000 or more in federal awards expended during the fiscal year
(200.501), raised from the prior threshold of $750,000. This is a number worth getting
exactly right, since older materials, older training, and some
still-uncorrected web pages continue to cite the $750,000 figure that no
longer applies to current fiscal years. An organization expending less
than the threshold in a given fiscal year is exempt from the Single
Audit requirement for that year, though it still has to keep its records
available for review.
When the Single Audit report is due
2 CFR 200.512 sets the submission deadline for the Single Audit
reporting package (submitted to the Federal Audit Clearinghouse) as
whichever comes first of two triggers: 30 days after the organization
receives the auditor's report, or nine months after the end of its
fiscal year. This "earlier of" structure means an organization cannot
simply wait for the nine-month mark if its auditor's report comes back
sooner, and it cannot use a late-arriving auditor's report as an excuse
to blow past the nine-month deadline either. The cognizant or oversight
agency for audit may authorize an extension when the nine-month timeframe
would place an undue burden on the auditee, and a due date that falls on a
weekend or federal holiday moves to the next business day. The Federal
Audit Clearinghouse (FAC) is the repository of record, and the data
collection form is submitted there along with the audit and reporting
package.
Why this connects back to subrecipient monitoring
Lesson 6 covered a pass-through entity's duty to verify that its
subrecipients are audited as required and to follow up on audit findings
that relate to the subaward. That duty
only makes sense once the Single Audit threshold, retention rules, and
submission deadlines covered here are understood, a pass-through entity
cannot meaningfully review a subrecipient's Single Audit report if it
does not know when that report is due, what threshold triggered the
requirement, or how long the underlying records have to be available for
its own review.
Two related but separate clocks: how long records must survive, and when a Single Audit is triggered and due.
Practice questions
1. Under 2 CFR 200.334, what is the baseline record retention period, and from what starting point?
Five years from the award start date, or until the next audit is completed, whichever comes first
One year from the award end date, unless the agency asks for the records sooner
Three years from the date the final financial report is submitted
Indefinitely, since records may never be destroyed under any federal award
Answer: c. The baseline is three years from the date of submission of the final financial report (or, for recurring reports, three years from each one).
2. If litigation or an audit begins before the three-year retention period expires, how long must records be kept?
Exactly three years regardless, since litigation does not extend the retention period at all
Until the litigation, claim, or audit is finally resolved, however long that takes
An additional fixed one year only, counted from the date the case or audit is opened
Records may be destroyed once litigation is filed, as the court then holds the originals
Answer: b. Pending litigation, a claim, or an audit started before the three-year period expires extends retention until that matter is finally resolved.
3. How long must records for property purchased with federal funds be retained?
Three years after the property's final disposition
Three years from the award start date only, the same as all other award records
One year after purchase, once the item has been inventoried and tagged
Property records need not be retained at all once the period of performance ends
Answer: a. Property and equipment records must be kept three years after final disposition (200.334(c)), not three years from the award's end.
4. As of fiscal years beginning on or after October 1, 2024, what is the Single Audit threshold?
$500,000
$750,000
$1,000,000
$2,000,000
Answer: c. The 2024 Uniform Guidance revision raised the Single Audit threshold to $1,000,000 in federal awards expended per fiscal year, effective for fiscal years beginning on or after October 1, 2024.
5. What was the Single Audit threshold before the 2024 revision?
$1,000,000
$500,000
$250,000
$750,000
Answer: d. The prior threshold was $750,000; it is important to use the current $1,000,000 figure since older materials still cite the old number.
6. What does a Single Audit cover, and why is it called "single"?
It covers only one specific federal program, chosen at random
It is one organization-wide audit covering financial statements and compliance across all federal programs, replacing separate audits for each individual program
It is conducted by a single auditor working alone with no firm behind them
It only applies once in an organization's lifetime
Answer: b. A Single Audit is one comprehensive, organization-wide audit covering financial statements and federal compliance, replacing what would otherwise be separate audits per program.
7. Under 2 CFR 200.512, when is the Single Audit reporting package due?
Always exactly 12 months after fiscal year end, with no possibility of an earlier deadline
Always exactly 30 days after fiscal year end, regardless of when the auditor's report arrives
The earlier of 30 days after receiving the auditor's report or 9 months after fiscal year end
There is no fixed deadline; each pass-through entity sets the date through its own written policy
Answer: c. The deadline is the earlier of 30 calendar days after the auditee receives the auditor's report or nine months after the end of the audit period (200.512(a)(1)), unless the cognizant or oversight agency authorizes an extension.
8. GCHS's auditor delivers its report 5 months after fiscal year end. When is the Single Audit reporting package due?
30 days after receiving the report (6 months after fiscal year end), since that is earlier than the 9-month mark
9 months after fiscal year end regardless of when the report arrived
Immediately upon receipt, with no 30-day allowance
There is no deadline once the auditor's report is late
Answer: a. Since 30 days after a report received at month 5 (month 6 total) falls before the 9-month mark, the earlier trigger, 30 days after receipt, governs.
9. Where is the Single Audit reporting package submitted?
Directly to NGMA
The Federal Audit Clearinghouse
The Internal Revenue Service
It is not submitted anywhere; it is kept internally only
Answer: b. The audit, the data collection form, and the reporting package are submitted to the Federal Audit Clearinghouse, which is the repository of record (200.512(b)).
10. An organization has an award with recurring quarterly financial reports rather than one final report. How does the three-year retention clock apply?
Retention starts only once, at the award's very start, and runs three years from that single date
Retention never applies to recurring-report awards, because each report replaces the last
The clock resets with each report, three years from each individual report's submission date
Only the final quarterly report matters; earlier ones can be discarded as soon as they are filed
Answer: c. For recurring reports, the three-year retention clock runs separately from each report's own submission date.
11. Can a federal agency or pass-through entity require records to be kept longer than the standard three years?
Yes, by notifying the organization in writing to extend the retention period, as 200.334(b) allows
No, three years is an absolute maximum in every case, even during pending litigation or an audit
Only NGMA can extend a retention period, by sending written notice to the organization's board
Only a court order can extend retention, never a written notice from an agency or a pass-through entity
Answer: a. 200.334(b) lets a federal agency, pass-through entity, cognizant agency for audit, oversight agency for audit, or cognizant agency for indirect costs extend retention by notifying the organization in writing, for instance for a pending review.
12. If GCHS expends $900,000 in federal awards in a fiscal year beginning after October 1, 2024, is a Single Audit required for that year?
Yes, because $900,000 exceeds the old $750,000 threshold
No, because $900,000 is below the current $1,000,000 threshold
Yes, all organizations receiving any federal funds must have a Single Audit every year
Only NGMA can determine this
Answer: b. $900,000 is below the current $1,000,000 threshold (a Single Audit is required at $1,000,000 or more), so a Single Audit is not required for that fiscal year on this basis, even though it would have exceeded the old $750,000 figure.
13. Why does understanding record retention and Single Audit rules matter for reviewing a subrecipient's compliance, as covered in lesson 6?
It doesn't connect; subrecipient monitoring and audit rules are unrelated
Because subrecipients are exempt from Single Audit rules entirely
Because NGMA requires it as a membership condition
A pass-through entity cannot meaningfully review a subrecipient's Single Audit report without knowing the threshold that triggered it, the deadline it was due by, and how long underlying records must be available
Answer: d. Reviewing a subrecipient's Single Audit report, part of the pass-through entity's monitoring duty from lesson 6, requires understanding the threshold, deadline, and retention rules covered in this lesson.
14. In this course's grouping of topics under NGMA's four domains, where do record retention and Single Audit compliance belong?
Grant Guidance
Fiscal Management
Program Management only
Grant Award only
Answer: b. This course groups recordkeeping and audit readiness under Fiscal Management, since they concern the financial paper trail and compliance verification of an award. NGMA's blueprint lists tasks rather than these topics by name, so treat the grouping as a study aid.
Glossary
2 CFR 200.334
The Uniform Guidance section setting the three-year baseline record retention period and its exceptions.
Single Audit
An organization-wide audit of financial statements and federal compliance, required when federal awards expended reach the threshold ($1,000,000 or more for fiscal years beginning on or after October 1, 2024) in a fiscal year.
2 CFR 200.512
The Uniform Guidance section setting the Single Audit reporting package submission deadline: the earlier of 30 days after the auditor's report or 9 months after fiscal year end.
Federal Audit Clearinghouse
The federal repository of record where Single Audit reporting packages and the data collection form are submitted (FAC.gov).