Auditors don't just hand over a clean opinion and walk away—they deliver a management letter that flags everything they found (and didn't find) wrong during the audit. Understanding what's actually in that letter determines whether your nonprofit ignores minor notes or acts on serious compliance gaps.
What Is an Audit Management Letter?
The management letter is a separate document from the auditor's opinion on your financial statements. It documents internal control deficiencies, compliance observations, and operational recommendations the auditor discovered during fieldwork. For nonprofits undergoing Form 990 audits, this letter often contains findings specific to grant compliance, donor restrictions, and revenue recognition—not just accounting mechanics.
The letter isn't a pass-fail tool. Instead, it's a risk assessment. A qualified auditor will categorize findings by severity and explain the actual impact to your operations, financial reporting, or regulatory standing.
Common Finding Categories
Nonprofits typically see findings fall into these buckets:
- Control weaknesses: Missing segregation of duties, weak approval processes, inadequate documentation
- Compliance gaps: Failure to meet grant requirements, donor reporting delays, or missing disclosures on the Form 990
- Accounting treatment issues: Incorrect revenue recognition, misclassified expenses, or improper reserve accounting
- Cash handling or asset management: Weak inventory controls, unsecured donations, or missing reconciliations
- Payroll and compensation: Missing W-9s, improper contractor classification, or lack of board approval for executive compensation
Each finding should include a description of what was wrong, why it matters, and what corrective action the auditor is recommending.
How to Read and Prioritize Findings
Not all findings carry equal weight. Your auditor should distinguish between material weaknesses (big problems affecting financial statements), significant deficiencies (moderate issues), and management letters (minor observations).
Start by asking your auditor to rank findings by risk:
- Does this affect financial statement accuracy? If yes, address it immediately.
- Does this expose us to grant loss or donor liability? If yes, prioritize it.
- Does this create operational inefficiency? If yes, schedule it for next quarter.
Many nonprofits receive 3–7 findings annually. If you're getting 15+, that's a signal your internal controls need a serious overhaul—and your auditor should be recommending a management consultant or internal control specialist to help.
Responding to Findings
Your response should be specific, not defensive. The auditor isn't trying to embarrass you; they're documenting what needs fixing. A strong response includes:
- Acknowledgment of the issue
- Root cause (why did this happen?)
- Corrective action (what will you do?)
- Owner (who's responsible?)
- Timeline (when will it be done?)
For example, instead of "We'll improve our approval process," write: "Effective January 1st, the Finance Director will approve all expenses over $5,000 using our new authorization matrix, documented in our updated accounting manual. Board Chair will review compliance monthly."
File these responses and track them. In next year's audit, the auditor will test whether you actually implemented your corrective actions.
When to Involve a Service Provider
If your organization is drowning in findings or you lack internal accounting expertise, this is when hiring an audit and Form 990 services firm makes sense. A good provider will:
- Help you remediate findings before the next audit
- Strengthen your bookkeeping and internal controls
- Ensure Form 990 accuracy and timely filing
- Coach your staff on compliance requirements
Expect to pay $3,000–$8,000 annually for a smaller nonprofit's audit (depending on revenue and complexity) plus another $1,500–$3,000 if you need remediation support. Mercoly helps you compare trusted Audit & Form 990 Services providers in one place, so you can find the right firm without calling around.
Red Flags in Audit Letters
Watch for these warning signs:
- Repeated findings from prior years (you promised to fix it but didn't)
- "Unable to obtain sufficient evidence" (your records are too messy to audit)
- Changes in auditor mid-engagement (possible disagreement on accounting methods)
- Findings that affect grant compliance (potential loss of federal funding)
Any of these warrant a sit-down conversation with your auditor before filing your Form 990.
Frequently Asked Questions
Q: What happens if we don't fix audit findings? Your next audit will flag the same issues, your donors may lose confidence, and funders may restrict grants pending remediation.
Q: Should the board see the management letter? Yes—the audit committee or full board should review it, discuss findings, and formally approve your corrective action plan.
Q: How do we know if findings are serious enough to disclose? If they affect financial statement accuracy or regulatory compliance, mention them in your Form 990 Part VII or supplementary disclosures; your auditor will advise.
Start your search for the right audit partner today—compare providers, review their remediation track record, and choose a firm that treats findings as a roadmap, not a gotcha.