Nonprofit audits are meant to give donors, grantmakers, and the public confidence in financial stewardship—but even the most rigorous external audit has clear boundaries. Understanding what auditors can't or won't test is just as important as knowing what they will, especially when you're planning your budget and timeline.
Why Scope Limitations Matter
An audit scope defines exactly what an auditor will examine and what falls outside their engagement. Scope limitations can result from client restrictions, practical constraints, or intentional exclusions negotiated upfront. For nonprofit leaders and finance teams, these limitations directly affect what assurances your audit will actually provide and where you may need alternative controls or procedures.
When you hire an auditor, the scope limitation discussion often happens during the engagement letter phase—typically 4–8 weeks before fieldwork begins. Getting this conversation right prevents costly surprises later.
Common Areas Auditors Won't Test
Related-party transactions beyond arm's-length review Auditors typically verify that related-party deals were disclosed and documented, but they generally don't forensically audit whether the price paid was fair or if conflicts of interest were properly managed. If your nonprofit has board members who also serve as vendors, an auditor will flag the relationship but usually won't independently investigate market rates or competitive bidding processes.
Compliance with grant-specific requirements While auditors test general financial controls and compliance with nonprofit tax law, they often don't perform detailed single audits of individual grant compliance unless that's explicitly part of the engagement. A grant funder's detailed programmatic requirements—like specific staffing ratios, service delivery timelines, or outcome reporting—fall outside a standard financial audit scope. Single audits under OMB Uniform Guidance require separate federal compliance testing and typically cost $3,000–$8,000 additional.
Historical periods not covered by the engagement If you hire an auditor for the first time, they won't audit prior years unless you pay for a separate extended scope engagement. Many nonprofits discover accounting errors from 2–3 years prior after a new audit relationship begins. Addressing these typically requires a management letter comment and, potentially, a restatement—but the auditor wasn't contracted to find them initially.
Internal control design beyond the audit period Auditors test controls that operated during the fiscal year under review. They won't evaluate controls you're planning to implement next year or assess whether your current system can scale for future growth. If you're adding a new software platform or restructuring your accounting department, discuss those changes with your auditor—they may affect current-year control testing but won't be formally evaluated until next year's audit.
Regulatory compliance outside financial reporting An audit of financial statements doesn't test employment law compliance, facility safety, program licensing, or state-specific nonprofit governance requirements. If your state requires annual Form 990 filing or specific board meeting documentation, your auditor won't verify that unless you hire them for agreed-upon procedures—a separate, typically lower-cost engagement ($1,500–$4,000).
What to Include in Your Audit Engagement Letter
When you're comparing audit firms and requesting proposals, clarify scope upfront:
- Dollar thresholds for testing: Will they test all transactions over $5,000, or use a different materiality level?
- Subsidiary or program testing: If you run multiple programs or affiliated entities, which will be audited and which consolidated?
- Grant compliance testing: Do you need single audit coverage for federal funds, or state-specific grant compliance?
- Manual journal entry testing: Will they review all manual entries or use a sample?
- Related-party transaction depth: What level of verification will they provide?
- Prior-year adjustments: If hiring an auditor for the first time, will they look back at prior years?
These details typically add $2,000–$6,000 to audit costs but eliminate confusion later. Nonprofit audit fees generally range from $5,000–$15,000 for organizations with annual revenues under $5 million, with larger scopes commanding higher fees.
Managing Scope Limitations Proactively
Don't wait for the audit to discover gaps. After reviewing the engagement letter:
- Ask your auditor to identify the three highest-risk areas outside the audit scope for your organization
- Consider hiring them for separate agreed-upon procedures (like grant compliance testing) at the same time
- Implement your own periodic reviews of high-risk areas between audits
- Document board-approved policies around related-party transactions, so you can demonstrate governance even if auditors don't deeply test them
Frequently Asked Questions
Q: Do I need both a financial audit and a single audit? You need a single audit (federal compliance audit) only if you spent $750,000 or more in federal funds in a fiscal year; otherwise, a financial audit alone typically suffices unless a specific grant funder requires it.
Q: Can my auditor test internal controls for IT security? Standard financial audits test IT controls related to financial data security and access; they don't perform cybersecurity penetration testing or evaluate non-financial system vulnerabilities—hire a separate IT security firm if you need that depth.
Q: What happens if we discover a major accounting error the auditor didn't catch? If the error falls outside the audit scope, the auditor has no liability, but they'll typically include it in a management letter and recommend a restatement; if it was in scope but missed, you may have grounds to discuss it with your auditor's quality review process.
Use Mercoly to compare and find trusted Audit & Form 990 Services providers who can clearly define scope and match your nonprofit's specific needs.