Types of Audit Findings (2 CFR 200)

An audit finding is not just any observation an auditor makes — under federal grant audit standards it is a specific, formally categorized type of result that a report must document in a standardized way, with defined elements and, in several cases, a defined dollar threshold before it must be reported at all. For an institution receiving federal research funding, most findings originate from the annual Single Audit required of any non-federal entity that expends $1,000,000 or more in federal awards in a fiscal year, conducted against the program-specific procedures in the OMB Compliance Supplement. A smaller number originate from a targeted OIG audit of a specific award or institution, which follows a related but not identical process. This guide covers the actual taxonomy: the categories of finding 2 CFR 200.516 requires an auditor to report, the severity ladder for internal-control findings, what a “questioned cost” is and is not, and how each finding type drives a different institutional response.

The Categories 2 CFR 200.516 Requires an Auditor to Report

2 CFR 200.516, in Subpart F of the Uniform Guidance, defines what must appear in a Single Audit’s schedule of findings and questioned costs. Not every category applies to every audit — an institution with strong controls and no questioned costs may have a report with none of these — but when a finding exists, it falls into one of these reportable categories:

Significant deficiencies and material weaknesses in internal control over a major program, evaluated relative to a specific type of compliance requirement identified in the Compliance Supplement (see the severity ladder below).
Material noncompliance with the statutes, regulations, or terms and conditions of a federal award, for a major program.
Known or likely questioned costs exceeding $25,000 for a given type of compliance requirement, for a major program.
Known questioned costs exceeding $25,000 for a federal program that was not audited as a major program in that cycle.
Circumstances requiring a non-unmodified opinion on compliance for a major program, with an explanation of why an unmodified opinion could not be issued.
Known or likely fraud affecting a federal award, unless it is already required to be reported as one of the categories above.
Instances where the summary schedule of prior audit findings materially misrepresents the status of a prior finding.

The $25,000 questioned-cost threshold and the major-program determination itself are two of the more frequently revisited figures in the Uniform Guidance, so confirm the current threshold against the live regulatory text or the current-year Compliance Supplement rather than assuming it is fixed permanently.

Internal Control Findings: The Severity Ladder

Internal-control findings are not binary — auditors classify them along a three-level severity scale drawn from Government Auditing Standards (GAGAS) and applied to Single Audits under Subpart F. The distinction matters because only the two more severe levels are separately reportable findings under 200.516; the first is a baseline concept the other two are defined against:

Control deficiency. The design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, misstatements or noncompliance on a timely basis. This is the baseline definition — not, by itself, a reportable finding.
Significant deficiency. A deficiency, or combination of deficiencies, in internal control that is less severe than a material weakness, yet important enough to merit attention from those charged with governance. Reportable, but does not by itself indicate that misstatement or noncompliance is likely to go undetected.
Material weakness. A deficiency, or combination of deficiencies, such that there is a reasonable possibility that a material misstatement of the entity’s financial statements, or material noncompliance with a type of compliance requirement for a major program, will not be prevented or detected and corrected on a timely basis. This is the most severe classification and the one most likely to trigger a high-risk auditee designation.

For the underlying regulatory requirement these findings are tested against, see the companion guide on institutional internal controls under 2 CFR 200.303.

Noncompliance Findings

A noncompliance finding is distinct from an internal-control finding: it documents an instance where the institution’s actual conduct violated a federal statute, regulation, or the specific terms and conditions of the award itself — regardless of whether the underlying control was well designed. A single instance can be both: a weak control (e.g., no second-level review of cost transfers) is the internal-control finding, and a specific cost transfer that violated the award’s terms as a result is the noncompliance finding. Only material noncompliance for a major program is a reportable finding under 200.516; immaterial, isolated instances an auditor happens to notice are typically communicated informally rather than included in the formal schedule of findings.

Questioned Costs: What Actually Qualifies

“Questioned cost” is itself a defined term under 2 CFR 200.1, not a loose description of any cost an auditor dislikes. An amount qualifies as a questioned cost when, in the auditor’s judgment, it falls into one of three bases:

Noncompliant or suspected noncompliant with federal statutes, regulations, or the award’s own terms and conditions.
Unsupported — at the time of the audit, the cost lacked adequate documentation to support that it complied with those requirements. (Where only part of a transaction lacks documentation, the questioned amount is calculated as if that unsupported portion were confirmed noncompliant.)
Unreasonable — the cost does not reflect the actions a prudent person would take in the circumstances.

Auditors further distinguish known questioned costs (a specific, quantified amount the auditor can point to) from likely questioned costs (the auditor’s best estimate of total questioned costs in a population, typically projected from a sample). Both count toward the $25,000 major-program reporting threshold in 200.516. A questioned cost is not the same as a disallowed cost: questioning a cost is the auditor’s finding; disallowing it is the separate, later determination the federal awarding agency or pass-through entity makes when it issues its management decision on the finding.

Fraud and Repeat Findings

Two further categories round out the taxonomy. Known or likely fraud affecting a federal award must be reported as a finding (unless it is already captured under one of the categories above), and typically triggers referral processes well beyond the audit itself — including, for HHS-funded research, potential referral to the funding agency’s Office of Inspector General regardless of whether that OIG initiated the audit. Repeat findings are not a fourth structural category so much as a status flag: 200.516 requires each finding to note whether it is a repeat of a finding in the two most recent prior audits, and separately requires the auditee’s summary schedule of prior audit findings to accurately reflect the status of those earlier findings. An inaccurate summary schedule is itself a reportable finding.

What Every Finding Must Contain

Regardless of category, 2 CFR 200.516 requires each finding in the schedule to be written to a consistent structure, so that the auditee and the federal agency or pass-through entity can act on it without follow-up clarification:

Identification of the federal program and specific award(s) involved (Assistance Listing number, federal award identification number).
Criteria — the requirement or specific goal the auditee was expected to meet.
Condition — the facts showing what was actually found, with enough detail to support the finding.
Cause — the reason for, or factors responsible for, the gap between condition and criteria.
Effect or potential effect — a clear, logical statement of the impact, sufficient for the reader to judge cause and effect and act on it.
Questioned costs and how they were computed, where applicable.
Context — information on whether the finding is an isolated instance or systemic, based on sample size and population where relevant.
Repeat-finding status, referencing the prior audit finding number if applicable.
Recommendation for corrective action.
Views of responsible officials, when the auditee disagrees with the finding.

How Severity Drives the Institutional Response

The category and severity of a finding determines what happens next, and on what timeline:

Corrective action plan. For every audit finding, the auditee must prepare a corrective action plan describing the specific steps to be taken and the anticipated completion date, submitted alongside the audit report (2 CFR 200.511). This applies uniformly — a significant deficiency and a material weakness both require one, though the scope and institutional attention they receive in practice differs sharply.
Management decision. The federal awarding agency or pass-through entity must issue a management decision on each audit finding — accepting the corrective action plan, requiring further action, or making a final determination on questioned costs (including whether they are disallowed) — generally within six months of the audit report’s acceptance by the Federal Audit Clearinghouse (2 CFR 200.521).
Risk designation and specific award conditions. A pattern of material weaknesses or unresolved findings is one of the factors a federal awarding agency weighs in designating a recipient higher-risk, which can bring more frequent reporting, additional prior approvals, or other specific conditions on future awards (2 CFR 200.208) — distinct from, but related to, the “high-risk auditee” concept tied to Single Audit results specifically.

OIG-initiated audits are governed by Government Auditing Standards and use materially the same finding vocabulary (condition, cause, effect, questioned costs), but resolution runs through the specific funding agency’s own audit-resolution process rather than the 200.521 six-month Single Audit benchmark — see the OIG audit guide for how that process differs in practice, and the OIG Reports term for the broader set of report types an Inspector General’s office publishes beyond individual audit reports.

Frequently Asked Questions

What’s the practical difference between a significant deficiency and a material weakness?

Both are internal-control findings and both require a corrective action plan. The difference is severity: a material weakness means there is a reasonable possibility that a material misstatement or material noncompliance will not be prevented, or detected and corrected, on a timely basis. A significant deficiency is less severe — worth governance-level attention, but without that same reasonable-possibility threshold. Material weaknesses are the classification most likely to affect a federal agency’s risk assessment of the institution.

Is a questioned cost the same as money the institution has to repay?

Not automatically. A questioned cost is the auditor’s finding that an amount may be noncompliant, unsupported, or unreasonable. Whether it is actually disallowed — and therefore owed back to the federal government — is a separate determination the federal awarding agency or pass-through entity makes in its management decision on the finding, generally within six months of the report’s acceptance.

Does every finding have to be reported, no matter how small?

No. 2 CFR 200.516 sets a $25,000 threshold for questioned-cost reporting on both major and non-major programs, and limits material-noncompliance and internal-control reporting to major programs specifically. Smaller or immaterial issues an auditor notices are typically communicated to management informally rather than included in the formal schedule of findings.

What happens if the same finding shows up in consecutive audits?

2 CFR 200.516 requires each finding to be flagged if it repeats a finding from either of the two most recent prior audits, and requires the auditee’s summary schedule of prior audit findings to accurately state whether earlier findings were actually resolved. A pattern of repeat findings, especially at the material-weakness level, is a specific factor federal agencies weigh in risk and oversight decisions about an institution.

Related CASRAI Resources

Single Audit (US) — the annual audit these findings most often originate from.
OMB Compliance Supplement — the program-by-program procedures auditors test against.
Institutional Internal Controls for Federal Grant Compliance — the 2 CFR 200.303 requirement internal-control findings are tested against.
How an OIG Audit of a Research Grant Works — the targeted-audit process alongside the annual Single Audit.
Federal Grant Compliance Checklist — practical basics for avoiding the findings described here.
Audit (grant) — the broader concept of a federal grant audit, including program-specific and agency-initiated audits.