GAGAS stands for generally accepted government auditing standards, the standards the US Government Accountability Office writes for audits of government entities, government programs, and the organizations that receive government money. The document carrying them is titled Government Auditing Standards, and it is known as the Yellow Book (GAO, Yellow Book: Government Auditing Standards). GAO issues them. The AICPA does not.
Nothing about GAGAS attaches automatically. Laws, regulations, contracts, grant agreements, and policies frequently require that engagements be conducted in accordance with GAGAS, and many audit organizations adopt the standards voluntarily (GAO, Government Auditing Standards, 2024 Revision, 1.08).
The current edition is the 2024 revision, which superseded the 2018 revision as technically updated in April 2021. It is effective for financial audits, attestation engagements, and reviews of financial statements for periods beginning on or after December 15, 2025, and for performance audits beginning on or after the same date (GAO, Government Auditing Standards, 2024 Revision).
GAGAS Does Not Replace GAAS
For financial audits, GAGAS incorporates by reference the AICPA’s Statements on Auditing Standards, every section of them, then adds requirements that auditors follow alongside the AICPA ones when citing GAGAS in the report. It does not incorporate the AICPA Code of Professional Conduct, though it recognizes that some CPAs may be required to use the code alongside it (GAO, 2024 Revision, 6.01 and 6.02).
So a GAGAS financial audit is a GAAS audit carrying a second layer, never a substitute for one. Performance audits are the other case, because GAGAS incorporates no other standards by reference for those, though it recognizes that auditors may use or may be required to use other professional standards alongside it (GAO, 2024 Revision, 2.15).
Vouching names the sections that carry generally accepted auditing standards, GAAS, and tests of controls sets out the seam where a governmental audit requirement calls for the testing even when reliance is not planned.
What Pulls a US CPA Firm Into a GAGAS Engagement
Federal award money is the usual route. The Single Audit Act Amendments of 1996 requires GAGAS in audits of state and local governments and nonprofit entities that receive federal awards, and Subpart F of the Uniform Guidance at 2 CFR part 200 reiterates it. State and local law, the terms of a contract, and federal audit guidance tied to program requirements can each require it on their own (GAO, 2024 Revision, 1.09 and 1.10).
The regulation is blunt about it. The audit must be conducted in accordance with GAGAS (2 CFR 200.514). Where the spending threshold that triggers that audit sits is worked through in fund accounting outsourcing.
What GAGAS Adds to the Firm
Independence and Nonaudit Services
GAGAS runs its own conceptual framework, applied at the audit organization, engagement team, and individual auditor levels to identify threats to independence, weigh them individually and in the aggregate, and apply safeguards that reduce them to an acceptable level (GAO, 2024 Revision, 3.27).
The definition of a nonaudit service is wider than the label suggests. A nonaudit service is one provided to an entity the firm also audits, and financial statement preparation, cash-to-accrual conversions, and reconciliations count as nonaudit services under GAGAS rather than routine activities, so auditors decide whether providing one creates a threat before they agree to it (GAO, 2024 Revision, 3.64 and 3.70).
Management holds up the other end. Auditors determine that the audited entity has designated an individual with suitable skill, knowledge, or experience who understands the service well enough to oversee it, and where the entity cannot or will not, the auditors conclude that providing the service impairs independence (GAO, 2024 Revision, 3.73 through 3.75).
Continuing Education Tied to the Engagement
Auditors who plan, direct, perform engagement procedures for, or report on a GAGAS engagement complete at least 80 hours of continuing professional education, CPE, in every 2-year period, with at least 20 hours in each year of that period. Of the total, 24 hours is subject matter directly related to the government environment, government auditing, or the specific or unique environment in which the audited entity operates, and 56 hours is subject matter that directly enhances professional expertise to conduct engagements (GAO, 2024 Revision, 4.16 and 4.17).
This count belongs to the engagement, not to the license. It runs alongside the hours a state board counts for renewal, a separate ledger.
External Peer Review
Each audit organization conducting engagements in accordance with GAGAS must obtain an external peer review conducted by reviewers independent of the organization being reviewed (GAO, 2024 Revision, 5.155).
Where the firm goes for it depends on affiliation. An audit organization affiliated with the AICPA complies with the AICPA’s own peer review requirements together with the GAGAS requirements at 5.161 through 5.175, while an organization not already subject to a peer review requirement obtains one at least once every 3 years (GAO, 2024 Revision, 5.156 and 5.179). A firm already enrolled in the AICPA peer review program therefore folds its GAGAS work into the review it already carries, rather than starting a second clock.
GAGAS and the Single Audit Are Not the Same Thing
The single audit is one engagement that requires GAGAS and then layers more on top. Beyond the requirements of GAGAS, the auditor must perform procedures to obtain an understanding of internal control over federal programs sufficient to plan the audit to support a low assessed level of control risk of noncompliance for major programs (2 CFR 200.514). A firm can conduct GAGAS work with no single audit anywhere near it.
Common Questions
The standard names four: financial audits, attestation engagements, reviews of financial statements, and performance audits (GAO, 2024 Revision, 1.14).
Three is the number of chapter sets, not engagement types. Financial audits pick up chapters 1 through 6, attestation engagements and reviews of financial statements chapters 1 through 5 and 7, and performance audits chapters 1 through 5, 8, and 9 (GAO, 2024 Revision, 1.16).
Generally accepted government auditing standards. The word accounting there usually points at a different comparison: GAGAS governs how the audit is conducted, while generally accepted accounting principles govern how the audited entity reports.
Accountably places trained offshore accountants and tax preparers inside US CPA and EA firms on accounting and tax work rather than audit fieldwork, and a firm can grade that work on its own files through a trial task.
