The Five Things Auditors Flag Every Time (And How to Make Sure They Don’t Flag Yours)

The executive director was newly hired, three months into her role, and her organization was about to undergo its first independent audit. She’d never been through one. She called us with a simple question: “What should I be worried about?”

It’s a great question. The honest answer is: probably not what you think.

Most nonprofit executives going into a first audit imagine the auditor finding some catastrophic error — missing money, fraud, a major miscoding that throws the financials into chaos. Those things do happen, but they’re rare. What auditors find, ninety-five percent of the time, are the same handful of issues showing up in different organizations:

• Missing internal controls
• Sloppy 1099 tracking
• Late or missing reconciliations
• Missing release-from-restriction entries
• Incomplete documentation

That’s it. Most audit findings come from this list. Which means audit preparation is mostly about closing five specific gaps — gaps you can identify and fix before the auditor ever walks in the door.

Why audit findings matter (even when they’re small)

A common misconception: audit findings are something to be embarrassed about, but they don’t really do anything.

In reality, audit findings have downstream effects:

• They appear in your audited financial statements, which become public and are reviewed by major funders, sophisticated donors, and government agencies
• They drive up audit costs the following year (more time = higher fees)
• They can affect your organization’s ratings with watchdog groups like Charity Navigator and GuideStar
• A pattern of findings over multiple years can become a red flag in grant applications

A clean audit isn’t just a nice-to-have. It’s a credibility asset that compounds over time.

Three questions that determine your audit readiness

1. Is Form 990 (or 990-EZ or 990-N) filed on time every year, with no last-minute scrambling?

The 990 isn’t the audit — it’s the IRS information return — but the two are deeply connected. A nonprofit that struggles with 990 timing usually has underlying issues that also affect the audit: incomplete records, late close processes, or disorganization that compounds.

The 990 is also public record. Anyone — donors, funders, journalists, future board members — can pull your 990s. They’re often the first thing a sophisticated funder looks at when deciding whether to fund you. Late or sloppy 990s are a credibility signal whether you intend them to be or not.

2. Are there basic internal controls in place: segregation of duties on money handling, dual approvals on large transactions, documented procedures?

This is the one most small nonprofits get wrong, usually with a version of “we’re too small for that.” The auditor doesn’t care that you’re small. Internal control gaps are flagged regardless of organization size.

The fundamentals are simpler than they sound:

• Segregation of duties: The person who records transactions shouldn’t be the same person who has signing authority on the bank account. The person who reconciles the books shouldn’t be the only one who reviews their work.
• Dual approvals: Any transaction over a defined threshold (often $1,000-$5,000 depending on org size) requires two signatures or approvals.
• Documented procedures: Written policies for how cash is handled, how expense reimbursements are processed, how vendors are onboarded, and how grant funds are disbursed.

Even at a five-person nonprofit, these controls are achievable — sometimes by involving a board member or volunteer treasurer in the review process. The key is documentation. An auditor doesn’t just want the controls to exist; they want evidence that they exist.

3. Are all 1099 vendors tracked throughout the year with W-9s on file — not chased down in January?

January 1099 chaos is the most preventable annual fire drill in nonprofit accounting. It happens because no one collected the W-9 when the vendor was first paid. By January, the vendor is no longer responsive, the address may have changed, and you’re issuing 1099s with incomplete information (or not at all).

The fix is structural. Vendor onboarding should collect the W-9 before the first payment. No W-9, no payment. It’s not a popular rule with new vendors, but it eliminates the January problem permanently.

The five most common audit findings (and how to avoid them)

Finding 1: Missing or weak internal controls

Documented procedures, segregation of duties, and dual approvals on significant transactions. If you don’t have these, this will be a finding.

Finding 2: Bank reconciliations not done timely

Auditors expect to see reconciliations completed within 30 days of month-end. Reconciliations done two or three months late get flagged, even if they’re eventually correct.

Finding 3: Release-from-restriction entries missing

Temporarily restricted balances on your Statement of Financial Position that should have been released (because the restriction was met) but weren’t. Auditors find these by tracing back through grant agreements and program activity.

Finding 4: 1099s not issued, or issued late

Self-explanatory. Common at organizations with informal vendor relationships. Easy to prevent with a W-9-on-onboarding rule.

Finding 5: Incomplete documentation supporting expenses

Expenses that don’t have receipts, invoices, or other documentation attached. Common at organizations that rely on credit card statements alone, or that have informal expense reimbursement processes.

Notice that none of these are about complicated accounting. They’re about process discipline. Which means they’re entirely within your control — if you start before the auditor arrives, not after.

When to start preparing for an audit

This is one of the most common questions we get from first-time-audited organizations. The answer surprises people: the audit prep starts in January, not August.

Here’s the timeline that works:

• January-March: Confirm audit firm engagement, review prior year findings (if any), make sure year-end is closed cleanly.
• April-June: Year-end close. Reconcile every account, post release entries, complete 990 prep, gather supporting documentation for the year.
• July-August: Audit fieldwork. Auditor reviews the books, asks questions, may request additional documentation.
• September-October: Draft audit report. Adjustments posted. Final report issued.

If you’re starting prep in August for a September audit, you’re already behind. The work isn’t impossible at that point, but it becomes a sprint instead of a marathon, and that’s where errors happen.

The story’s epilogue

The executive director we opened with went through her first audit with one finding — and even that was a minor recommendation about documentation, not a material weakness. Not because we did anything fancy. We spent the months leading up to the audit closing the five gaps in the list above: tightened controls (mostly with documentation, since the controls already informally existed), caught up reconciliations to within 30 days, posted six release-from-restriction entries that should have been posted earlier in the year, verified all 1099 vendors had W-9s on file, and confirmed documentation was attached to expenses.

The audit took two and a half weeks instead of the four-to-five the auditor had originally estimated. The audit fee came in below the original quote because there was less to do.

That’s the compound benefit of audit readiness done well: cleaner findings, lower fees, and a credibility asset that lasts.

What to do this month

Pull your last audit report (or, if you’ve never had one, pull your last 990).

Look for two things:

1. Any findings or recommendations from the auditor. Are they still unaddressed?
2. Anything that surprised you, or anything you didn’t fully understand at the time.

Both are signals for where to focus next. Old findings tend to recur. Things you didn’t understand at the time are usually things that still need to be addressed.

Two ways to go deeper:

• Download the Nonprofit Bookkeeping Health Check— fifteen questions across five categories, including the three from this post and twelve more. This is the same checklist we walk through with new clients.
• Book a free 30-minute Finance Review— we’ll look at your last audit (or 990) and your current setup and tell you honestly where the gaps are. No pitch. Some organizations just need confirmation that they’re in good shape.

That wraps the series. Five posts, five categories, fifteen questions worth asking about your organization’s books. The work of getting them all to “yes” is real — but it’s also achievable, one quarter at a time, and the benefits compound. Cleaner audits. Faster board meetings. Funder reports that take minutes instead of days. And the freedom to spend more of your time on the mission instead of the mechanics.

Previous in series: Where Restricted Funds Go to Die

Back to start: Was Your Chart of Accounts Built for a Nonprofit?

*Details have been changed to protect client confidentiality.