CPA review vs audit: two compliance paths for NYC charities

It changes the level of assurance attached to the financial statements, the work expected from the accounting firm, the board’s governance responsibilities, and—often—the organization’s relationship with funders and lenders.

New York’s state filing framework uses gross annual revenue and support to determine which financial statement filing tier applies. Organizations below $250,000 generally file an unaudited financial report for state purposes. Organizations between $250,000 and $1 million generally need an independent CPA review. Organizations above $1 million generally need an independent CPA audit and must meet additional audit committee requirements under New York law.

That is the state framework, not the whole compliance universe. A grant agreement can require audited statements even when a charity falls below the $1 million state threshold. A lender may impose the same condition in a financing agreement. Federal awards can trigger separate audit obligations based on federal expenditures and the rules applicable to the relevant reporting period.

The practical question is therefore not only “What does New York require?” It is also “What do our contracts, funders, lenders, and federal awards require?”

New York’s revenue threshold determines the state filing tier. It does not override an audit requirement written into a grant agreement, loan document, or federal award.

Navigating the $250K and $1M Revenue Thresholds

The state framework has three broad tiers, but the thresholds need to be read carefully. Revenue and support determine the filing category; they are not a universal answer to every audit question a charity may face.

At or below $250,000

A charitable organization with gross annual revenue and support at or below $250,000 generally does not need to attach either a CPA review report or an independent audit report to its New York charitable filing. It still has filing obligations, however. The organization must submit the appropriate Form CHAR500 filing and provide the financial information required for its reporting category.

This is the tier where small neighborhood associations, emerging service organizations, and volunteer-led charities often operate. The absence of a CPA engagement does not mean the organization can let its books drift. A board still needs reliable information about cash, restricted grants, outstanding liabilities, payroll, and program spending. It also needs a process for approving payments and reconciling bank accounts.

Unaudited does not mean ungoverned. It means New York’s state filing rules do not require the additional CPA report at that revenue level.

Between $250,000 and $1 million

Once gross annual revenue and support falls between $250,000 and $1 million, the organization generally enters CPA review territory for its New York filing. The financial statements must be accompanied by an independent CPA’s review report prepared under the applicable professional standards.

A review is less extensive than an audit, but it is not an internal bookkeeping check and not a form signed by the organization’s regular tax preparer without additional work. The CPA performs analytical procedures and makes inquiries of management. The engagement is designed to provide limited assurance that the financial statements do not require material modification for conformity with the applicable accounting framework.

This is often the most confusing tier for boards. A review may be sufficient for the Charities Bureau filing, but it may not satisfy every outside party that has a financial reporting requirement. Some institutional funders accept reviewed financial statements; others insist on audited statements once a grant reaches a particular size or once the organization has a certain risk profile. The governing document is the grant agreement, not the organization’s assumption about what a charity of its size “usually” provides.

Above $1 million

Organizations above the $1 million state threshold generally need an independent CPA audit for the New York filing. The audit provides reasonable assurance through a more extensive process that includes risk assessment, evaluation of internal controls relevant to the financial statements, substantive testing, and other procedures designed to obtain sufficient appropriate audit evidence.

This is also the tier where governance requirements become more demanding. Under N-PCL § 712-a, an organization required to file an independent CPA audit must have an audit committee made up entirely of independent directors, or the full board may perform the audit committee function subject to the statute’s requirements for independent participation and voting.

The threshold changes over the last decade made an important change in direction. New York raised the level at which an independent audit is required, including the move to a $750,000 threshold effective July 1, 2017, and later to $1 million effective July 1, 2021. Those increases moved some organizations that had previously been in mandatory-audit territory into the review tier. They did not automatically pull charities from review into audit territory.

That distinction matters when a board is trying to reconstruct its compliance history. A charity that moved from audit to review after a threshold increase may still have contractual, lender, or federal reasons to continue obtaining an audit. Conversely, a charity that grows from review territory toward $1 million needs to plan for a more demanding engagement before the year-end numbers make the decision unavoidable.

The state category is determined by the organization’s gross annual revenue and support, not simply by the amount of cash in the bank at year-end. A charity may have a modest operating budget but receive a large restricted award, report significant noncash support, or experience a year with unusual grant revenue. The finance committee should understand which amounts are included in the relevant calculation and how the organization’s accounting policies affect the reporting picture.

A board that waits until the final month of the fiscal year to consider the threshold is already late. The organization should track its position during the year, identify restricted and unrestricted revenue correctly, and ask whether a pending grant or contract could change the reporting tier.

The choice between a review and an audit is not made for you by one number on the financial statements. That number determines the New York state filing tier. The final compliance requirement may be higher because of a grant agreement, financing covenant, federal award, or the expectations of a major institutional funder.

Limited vs Reasonable Assurance: Understanding the CPA’s Role

The language of assurance can sound abstract until a board sees what the CPA is actually doing.

A CPA review provides limited assurance. The accountant primarily performs analytical procedures and inquiries of management. That may include comparing current-year results with prior periods, investigating unusual fluctuations, asking how restricted funds are tracked, discussing significant liabilities, and considering whether the financial statements appear consistent with the information provided by management.

The resulting conclusion is expressed in negative form: nothing came to the CPA’s attention suggesting that the financial statements require material modification. That wording is deliberate. It does not say that the CPA tested every material transaction or established that the statements are free of material misstatement.

A review generally does not include the same level of transaction testing, confirmation procedures, or internal-control evaluation as an audit. The CPA is not reconstructing the organization’s accounting system transaction by transaction. That narrower scope is why the engagement is less expensive and usually faster.

An audit provides reasonable assurance, which is a higher level of assurance but not an absolute guarantee. The auditor assesses risks of material misstatement, designs procedures in response to those risks, tests selected transactions and balances, considers relevant controls, and seeks evidence from both internal records and external sources where appropriate. Depending on the organization, the work may involve bank confirmations, testing of grant revenue and expenses, review of payroll controls, examination of restricted funds, testing of accounts payable, and evaluation of related-party transactions.

The audit concludes with an opinion on the financial statements. The opinion may be unmodified, or it may be qualified, adverse, or a disclaimer, depending on the circumstances and the auditor’s ability to obtain sufficient evidence.

What a review can and cannot establish

A review may identify a problem. A CPA can ask questions about an unexplained variance, request an adjustment, or determine that the financial statements need modification. A review is not designed to ignore fraud, going-concern concerns, or significant accounting issues simply because it is a limited-assurance engagement.

At the same time, a review is not designed to uncover every issue that an audit might reveal. A control failure that never produces an obvious fluctuation may not surface through analytical procedures. A misclassified restricted grant may look ordinary in a high-level comparison. A payment to a related party may not be apparent unless management discloses the relationship or the CPA’s inquiries bring it to light.

That is the practical difference between the two paths. A review asks whether anything has come to the CPA’s attention indicating that the statements need material modification. An audit gathers substantially more evidence to support an affirmative opinion that the statements are free of material misstatement.

Why outside requirements can change the answer

A charity in the $250,000–$1 million range may be legally entitled to file a review report with New York and still need an audit for another reason.

Common examples include:

• A grant agreement requiring audited financial statements, even though state law would accept a review.
• A lender or line-of-credit agreement requiring an annual audit or audited financial ratios.
• A federal award structure that brings the organization within separate federal audit requirements.
• A major foundation that will not renew funding without audited statements.
• A merger, acquisition, or other strategic transaction in which the receiving organization wants audit-level financial information.
• A board-approved policy requiring an audit because the organization manages significant restricted funds or government contracts.

The organization should review these requirements before signing the CPA engagement letter. Discovering after fieldwork begins that a funder needed audited statements creates the worst of both worlds: the charity has paid for a review and may still need to pay for an audit.

A CPA review is not a cheaper audit. It answers a different question, using a different level of work. The right engagement is the one that satisfies the organization’s actual obligations—not merely the lowest state-law tier.

Governance Mandates: Audit Committee Requirements under N-PCL § 712-a

The audit committee is not a ceremonial title to add to the board roster when revenue crosses $1 million. It is a working governance function.

For charities required to file an independent CPA audit, N-PCL § 712-a requires an audit committee composed entirely of independent directors, subject to the statute’s requirements. Independence is not determined by whether a director feels impartial. A material business relationship, compensation arrangement, family relationship, or other connection can affect eligibility.

The executive director should not be treated as an independent audit committee member simply because the executive director does not vote on financial statements. The treasurer may or may not qualify depending on the person’s relationship with the organization and the nature of the role. A founder who provides paid services, leases property to the charity, or has another material financial connection may also create an independence issue.

Small NYC boards often discover the problem late. Their directors may be dedicated and competent, but several may also be vendors, landlords, consultants, relatives of staff, or recipients of payments connected to the organization. A board that has enough people for a quorum may not have enough independent directors for a functioning audit committee.

The law allows the full board to perform the audit committee function in certain circumstances, but that does not eliminate the independence requirement. The organization must document which directors are independent and ensure that only eligible independent directors vote on matters reserved for the audit committee.

That means the board should address the issue before the audit begins, not during the final meeting at which the financial statements are approved. The minutes should show who participated, who recused themselves, what the committee reviewed, and what recommendations it made.

What an effective audit committee actually does

An effective committee has work to do before, during, and after the audit.

Before fieldwork, it should:

• Review the engagement letter and confirm the scope of the audit.
• Ask the CPA about significant risk areas and planned procedures.
• Discuss restricted grants, government contracts, related-party transactions, revenue recognition, and cash controls.
• Confirm the auditor’s independence and understand any non-audit services provided by the firm.
• Make sure management has assembled the records the auditors will need.

During the engagement, the committee should maintain a channel with the CPA that does not depend entirely on management. At least one private conversation between the independent directors and the auditor is a sound practice. It gives the auditor an opportunity to raise concerns about management access, delayed schedules, control deficiencies, or disagreements over accounting treatment.

After fieldwork, the committee should review:

• The draft financial statements and auditor’s report.
• Any management letter or internal control recommendations.
• Proposed audit adjustments and passed adjustments.
• Difficulties encountered during the engagement.
• Significant estimates, concentrations, and going-concern matters.
• Management’s plan and timetable for correcting control weaknesses.

The committee should then report to the full board in language directors can understand. “The audit was clean” is not enough. Directors need to know whether the auditor identified weaknesses in cash disbursements, grant tracking, payroll approvals, segregation of duties, or financial close procedures.

For a small charity, the committee may not have a full-time controller or an internal audit department to support this work. That makes disciplined preparation more important, not less. A simple annual calendar can help: select or evaluate the auditor early, approve the engagement, schedule the private meeting, review the draft report, and assign responsibility for remediation.

A committee that meets once for ten minutes, approves the report, and never follows up on the management letter is technically present but functionally absent.

Operational Costs and Strategic Budgeting for Compliance

The cost difference between a CPA review and an audit is real, but the invoice is only one part of the financial impact.

A review generally costs less because the CPA performs fewer procedures and assumes a narrower engagement scope. An audit costs more because the firm must obtain more evidence, assess more risks, test more balances and transactions, and document its conclusions in greater detail.

For a mid-sized NYC charity with reasonably organized books, a review may fall in the lower five-figure range or below, while an audit may begin around the low five figures and rise with complexity. These are planning ranges, not regulated prices. Fees vary by firm, staffing model, program complexity, quality of the books, number of restricted funds, government contracts, payroll size, and the amount of cleanup required before fieldwork can begin.

The largest cost drivers usually include:

• Multiple funding streams with different restrictions and reporting rules.
• Government grants that require detailed expenditure support.
• Weak or inconsistent account reconciliations.
• Delayed monthly closes.
• Significant receivables or deferred revenue.
• Related-party transactions.
• In-kind contributions and noncash support.
• Multiple entities or consolidated financial statements.
• A first-year audit in which the CPA must learn the organization’s systems.
• A federal award structure requiring additional audit work.

The phrase “CPA review vs audit cost nonprofit” is therefore useful only as a starting point. Two organizations with the same revenue can receive very different quotes. The charity with clean reconciliations, organized grant files, and a functioning approval process may pay less than a smaller organization whose records require extensive reconstruction.

Budgeting for the threshold crossing

The most expensive time to discover the need for an audit is after the fiscal year has closed. By then, the charity may have already spent the year using review-level processes, failed to retain supporting documentation, or missed a chance to negotiate the engagement timeline.

A board expecting growth should budget for the audit before crossing the line. That means more than adding a professional-fees estimate. The organization may need additional staff time for the financial close, better accounting software, outside support for grant tracking, and board time for audit committee work.

A charity with revenue close to $1 million should model several scenarios:

1. What is the expected revenue and support for the current fiscal year?

2. Which pending grants or contract renewals could move the organization into the audit tier?

3. Do any funders or lenders already require audited statements?

4. Can the accounting team close the books promptly enough for the CPA’s schedule?

5. Are restricted funds tracked by award, program, and reporting period?

6. Does the board have enough independent directors to perform the audit committee function?

7. Should the organization obtain an audit voluntarily before it is legally required?

Voluntary auditing can make sense when an organization is preparing for institutional growth, seeking larger government contracts, negotiating financing, or trying to reassure a major funder. It can also be unnecessary expense if no stakeholder requires it and the organization’s systems are not ready to use the audit as a management tool. The decision should be tied to strategy, not prestige.

The first audit is a systems test

A first audit often exposes operational weaknesses that have been invisible in day-to-day work. The CPA may request documentation for every significant grant, ask how management approves payroll, examine who can create vendors, and test whether bank reconciliations are reviewed by someone other than the preparer.

That process can feel intrusive, especially for a founder-led organization where a small group of people has handled everything for years. But the audit is also a chance to identify risks before a funder, whistleblower, or regulator identifies them first.

A board should treat the management letter as an operating document. Each recommendation should have an owner, a due date, and a follow-up process. “Improve segregation of duties” is not a completed action. The organization should specify which person prepares payments, who approves them, who releases them, and who reviews the bank activity afterward.

Filing Deadlines and the Mechanics of Form CHAR500

Form CHAR500 is the annual financial report used by New York charities subject to the state charitable filing requirement. The filing generally includes the organization’s financial information and, depending on the revenue tier, the required unaudited report, CPA review report, or independent audit report.

The filing deadline is generally four months and fifteen days after the end of the organization’s fiscal year. A charity with a calendar fiscal year should not wait until the deadline month to call its CPA. The financial statements, board approvals, CPA report, and any required attachments all have to line up.

The filing process typically requires the organization to:

• Confirm the fiscal year-end and the organization’s registration information.
• Prepare final financial statements using consistent accounting policies.
• Determine the applicable revenue and support tier.
• Obtain the required CPA report, if the organization falls into the review or audit category.
• Complete the CHAR500 and related schedules accurately.
• Include the correct filing fee and any required attachments.
• Secure the appropriate officer or board approval.
• Submit the filing through the required state process and retain proof of submission.

The organization should also check whether it has other state or local filing obligations. Registration with the Charities Bureau is not the same thing as satisfying every corporate, tax, licensing, or contract-reporting requirement. A charity may have obligations to the IRS, New York tax authorities, a city agency, or a government grant administrator that operate on different calendars.

Extensions are not a substitute for preparation

An extension may be available under the applicable filing rules, but it does not remove the obligation to obtain the correct financial statement report. It also does not automatically extend every related filing deadline. The organization should confirm the extension procedure and calendar the new deadline in writing.

A late filing can create practical problems beyond a state notice. Funders reviewing a renewal application may see an incomplete compliance record. A lender may ask why the annual financial package was not delivered. A board may approve a grant proposal without realizing that the prior year’s financial report has not been filed.

The finance director or treasurer should maintain a compliance calendar that includes:

• Fiscal year-end close.
• Internal financial statement review.
• CPA engagement approval.
• Audit committee meetings.
• CPA fieldwork.
• Board approval of the final statements.
• CHAR500 submission.
• Federal, tax, grant, and lender deadlines.
• Follow-up dates for audit findings and management-letter items.

This calendar is particularly important when the organization changes fiscal years, receives a large grant late in the year, or has staff turnover in finance or operations.

Reconcile the state filing with the organization’s wider reporting obligations

A charity should compare the information in its CHAR500 filing with the statements it provides to funders and lenders. Differences may be legitimate because different reports serve different purposes, but unexplained inconsistencies can create credibility problems.

The same discipline applies to federal awards. If the organization receives federal funds, it should determine whether the applicable expenditure level and award terms create a separate audit requirement. That analysis may depend on when the funds were spent, not simply on total organizational revenue. Federal requirements can therefore apply to a charity below New York’s $1 million audit threshold.

The phrase “new york nonprofit audit requirements” is often used as though there were one universal rule. In practice, a charity must map several overlapping systems: New York’s filing tiers, the organization’s governing documents, grant and loan contracts, federal award rules, and the expectations of its principal stakeholders.

Making the Decision Before It Becomes a Deadline Problem

The review-versus-audit decision should begin with a revenue forecast and end with a documented compliance conclusion. The board or finance committee should be able to explain which state tier applies, which outside requirements were reviewed, and why the chosen engagement meets those requirements.

For a charity comfortably below $250,000, the focus should be on accurate books, basic controls, and timely filing. For a charity between $250,000 and $1 million, the review should be treated as an independent financial reporting engagement—not a rubber stamp. For a charity approaching or exceeding $1 million, the organization should plan for audit-level documentation and confirm that its board structure can support the required audit committee function.

The best time to ask a CPA for a quote is before year-end. The best time to review independence and committee composition is before the engagement letter is signed. The best time to correct weak controls is before the auditor selects a sample.

New York’s thresholds provide a useful starting map, but they do not make the strategic decision by themselves. A state-compliant review may still be inadequate for a funder. An audit may be legally unnecessary but operationally valuable. And an organization that crosses the $1 million line without preparing its systems and governance structure can turn an ordinary annual filing into an avoidable financial and managerial disruption.

The right compliance path is the one that matches the organization’s revenue, contracts, funding sources, risk profile, and capacity to produce reliable financial information. For an NYC charity, that is the difference between merely filing a report and building a financial reporting process that people outside the organization can trust.