A small city receives $3 million in federal grant money for a job training program. Its board hires a CPA firm to audit the financials. Halfway through fieldwork, the partner realizes the firm also built the city's general ledger from scratch last year. Under AICPA rules, that might be fine with safeguards. Under the GAO Yellow Book, it is almost always a problem. Government auditing layers extra rules on top, and the exam tests where those layers diverge.
The U.S. Government Accountability Office (GAO) publishes Government Auditing Standards, almost always called the Yellow Book. These standards govern audits of government entities and organizations receiving federal funds when a law, regulation, or contract requires it.
The Yellow Book does not stand alone. It builds on AICPA standards. When you perform a Yellow Book financial audit, you follow AICPA Clarified Statements on Auditing Standards (SAS) plus the Yellow Book additions. The combined framework is called generally accepted government auditing standards (GAGAS).
KEY: GAGAS = AICPA + Yellow Book additions. If a question describes a federal grant recipient, a state agency, or a local government, GAGAS likely applies.
Common mistakes
- Treating Yellow Book as a replacement for AICPA. The Yellow Book layers on top. If an answer says "the auditor follows Yellow Book instead of AICPA," it is wrong.
- Confusing the two extra reports with attestation opinions. They report deficiencies and noncompliance noticed during the audit. They are not opinions on internal control effectiveness. A separate attestation examination is needed for that.
- Missing the 24-hour government-specific CPE rule. Yellow Book requires 80 hours every two years, but 24 must be government-specific. 80 hours of generic CPE fails.
Bottom line
- Yellow Book = GAO Government Auditing Standards (GAGAS). Applies to government entities and many recipients of federal funds.
- GAGAS = AICPA standards plus Yellow Book additions. It layers on top, it does not replace AICPA.
- Yellow Book covers four engagement types: financial audits, attestation engagements, performance audits, and nonaudit services.
- Yellow Book auditors must complete 80 hours of CPE every 2 years (24 must be government-specific, 20 in any single year).
Exam shortcut
If the entity is a government or federal grant recipient, default to GAGAS. Then ask: is the question testing the AICPA layer (skepticism, evidence, opinion) or the Yellow Book layer (independence, CPE, the two extra reports)? The two extra reports cover internal control over financial reporting and compliance with laws and regulations. They report deficiencies and instances, not effectiveness opinions. CPE numbers: 80 / 24 / 20.
The full lesson (about 1,898 words, 13 min read) adds 1 worked example, all 5 common mistakes, a self-check, free in the app.
Learning objectives
- I.C2
Browse all free CPA AUD lessons or jump into free CPA AUD practice questions.