Q3 2026: Federal Funding, Grant Compliance, and More

OMB’s 2026 Compliance Supplement remains pending

As of Oct. 23, 2026, the Office of Management and Budget (OMB) had not issued the 2026 Compliance Supplement. The supplement identifies the federal program requirements subject to audit and provides important guidance for auditors performing single audits under the Uniform Guidance.

The 2026 Compliance Supplement will apply to single audits of fiscal years beginning after June 30, 2025 – that is, audits of fiscal years ending on or after June 30, 2026. Association of International Certified Public Accountants Governmental Audit Quality Center (GAQC) Alert No. 504 reminds governments and auditors that single audit reports for these fiscal years should not be issued until the OMB releases the final 2026 supplement.

On Sept. 28, the GAQC also made OMB’s draft 2026 supplement available for audit planning. Until OMB issues the final supplement, recipients and pass-through entities should monitor developments and coordinate with their auditors regarding potential effects on audit scope and timing. Because the draft is not final, auditors will need to compare it with the final supplement when issued and incorporate any changes before issuing their reports.

Continuing resolution maintains federal grant programs but creates short-term uncertainty

On Sept. 2, 2026, the president signed H.R. 6500, the Continuing Appropriations and Extensions Act, 2027. The law generally funds federal agencies through Dec. 11, 2026, at fiscal year 2026 operating rates and under the authorities and conditions contained in the prior year’s appropriations acts. This temporary funding allows agencies to continue administering existing programs and awards but does not establish final fiscal year 2027 funding levels.

The law generally prohibits agencies from initiating or resuming projects or activities that were not funded in fiscal year 2026. It also directs agencies to avoid making large initial distributions to states, grantees, and other recipients or awarding grants that could restrict Congress’s final funding decisions. Consequently, some formula and block grant funding may be released incrementally, while notices of funding opportunities and new discretionary grant awards may be delayed, limited, or conditioned on the enactment of full-year appropriations. The timing and effect will vary by agency and program. The continuing resolution does not generally cancel existing awards, although funding uncertainty may affect the timing of new obligations, award modifications, and future funding increments.

State and local governments should distinguish among obligated awards, announced selections for which awards have not been finalized, pending applications, and anticipated fiscal year 2027 funding. Governments also should confirm funding and payment schedules with federal awarding agencies and pass-through entities, evaluate possible effects on budgets, cash flow, procurement, project schedules, and subrecipient commitments, and avoid assuming that prior-year funding levels will continue for the full fiscal year. Further congressional action will be necessary before the continuing resolution expires on Dec. 11.

Congress pauses proposed revisions to federal financial assistance rules

H.R. 6500, the Continuing Appropriations and Extensions Act, 2027, also temporarily prevents the OMB from issuing or finalizing its rule, Regulation for Federal Financial Assistance, or a substantially similar rule, through Dec. 11, 2026.

The OMB proposal would significantly revise the governmentwide requirements for grants, cooperative agreements, and other federal financial assistance including the Uniform Guidance in 2 CFR Part 200. Proposed changes would affect award termination, fixed-amount awards and subawards, notices of funding opportunities, internal controls, procurement, subrecipient determinations, cost allowability, E-Verify participation, mandatory disclosures, and other award-administration requirements.

The statutory pause does not withdraw the proposal, and current Uniform Guidance requirements remain in effect. Recipients and pass-through entities should continue applying existing requirements while evaluating where the proposal could affect policies, systems, award terms, subawards, procurement processes, and internal controls if a final rule is issued. Because the restriction expires Dec. 11 unless Congress takes further action, federal award recipients should continue monitoring developments and avoid implementing proposed requirements before they become final and applicable.

GAO highlights fraud risks in federally funded, state-administered programs

On July 23, 2026, the Government Accountability Office (GAO) issued – and on Aug. 7 reissued with revisions – a report examining fraud risks in 20 of the largest federally funded programs administered by states and other governmental entities. The programs, which include Medicaid, the Supplemental Nutrition Assistance Program, housing assistance, disaster assistance, highway funding, and education programs, collectively accounted for approximately $1.1 trillion in federal obligations during fiscal year 2025.

The GAO found that the involvement of recipients, subrecipients, contractors, service providers, and beneficiaries can help deliver essential services but also creates opportunities for fraud. Only five of the 20 programs had documented evidence consistent with identifying fraud risks and assessing their likelihood to prioritize responses. The GAO identified risks involving eligibility and identity, provider and contractor integrity, false documentation, duplicate or improper payments, conflicts of interest, and oversight of funds passed through to other entities.

The GAO encouraged federal and state agencies to apply established fraud risk and improper payment frameworks, use data analytics and federal resources such as the Do Not Pay program, and address previously identified control weaknesses. State and local government leaders should consider whether responsibility for fraud risk management is clearly assigned and whether program administration, finance, grants management, procurement, information technology, and internal audit functions are coordinating to prevent and detect fraud across federally funded programs.

SLFRF recipients approach final expenditure deadline and closeout requirements

Recipients of coronavirus SLFRF should prepare for the program’s approaching final expenditure deadline and closeout requirements. The U.S. Department of the Treasury’s (Treasury) September 2026 SLFRF newsletter reminds recipients that the expenditure deadline for Surface Transportation and Title I eligible-use projects was Sept. 30, 2026, while the general deadline to expend SLFRF is Dec. 31, 2026. Funds not expended by the applicable deadline generally must be returned to Treasury.

Treasury also has established a SLFRF Closeout Resource Hub that includes a closeout preparation checklist, process overview, portal instructions, and other resources. Recipients that have reported fully obligating and expending their allocations may be invited by Treasury to close out their awards early. Fully expending an award does not automatically close it, however, and recipients should continue submitting required reports until Treasury confirms that their awards have been closed.

Quarterly reporters must submit their third quarter 2026 Project and Expenditure Report by Oct. 31, 2026. Quarterly and annual reporters that have not completed closeout generally must submit their final Project and Expenditure Report by April 30, 2027. Treasury’s recently issued FAQs also permit recipients, subject to specified conditions, to process or correct final subrecipient invoices and reissue uncashed checks through April 30, 2027.

As the Dec. 31, 2026, deadline approaches, recipients should reconcile reported expenditures to their accounting records, resolve outstanding invoices and contracts, review subrecipient reporting and monitoring, verify that expenditures comply with program requirements, and retain documentation supporting eligibility, procurement, performance, and other compliance matters. Governments also should keep their Treasury portal contacts current and confirm how any unexpended funds will be identified and returned.

New federal housing law expands tools and requirements for state and local governments

On July 11, 2026, the 21st Century ROAD to Housing Act became law. The broad housing package modifies several federal programs administered by state and local governments and creates new opportunities and responsibilities related to affordable housing, community development, disaster recovery, and housing supply planning.

Among its most significant provisions, the law reauthorizes and expands the HOME Investment Partnerships Program, permits Community Development Block Grant (CDBG) recipients to use up to 20% of their annual grants for new affordable-housing construction, and authorizes the CDBG-Disaster Recovery program for three years. It also requires CDBG recipients to maintain searchable public databases of publicly owned undeveloped land and establishes a mechanism that could increase or decrease certain CDBG allocations based on local housing unit growth. Other provisions authorize competitive grants for housing planning, home repairs, redevelopment of vacant properties, and other housing supply initiatives.

Many of the law’s provisions will require Department of Housing and Urban Development (HUD) guidance, rulemaking, funding notices, or additional congressional appropriations before they are fully implemented. State and local governments should review the law’s potential effect on their CDBG and HOME programs, begin evaluating publicly owned land data, monitor forthcoming HUD implementation materials, and assess whether local housing growth measures could affect future funding.

CISA releases cybersecurity resource package for K-12 schools and districts

On Aug. 12, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) released its K-12 Cybersecurity Foundations Resource Package. Designed for school leaders, nontechnical personnel, and information technology professionals, the package includes guides, videos, and reference materials addressing credential protection, technology assets, backups, incident response, training, sensitive data, and longer-term cybersecurity planning.

Although the resources do not establish new mandatory requirements, school districts can use them to assess existing safeguards, identify gaps, assign responsibility, and prioritize cybersecurity investments. Governing officials and internal auditors also should consider whether incident response plans are tested, backups can be restored, access controls operate as intended, and significant cyber risks are communicated through the district’s governance and enterprise risk processes.

ASB approves enhanced fraud auditing standard

On Aug. 19, 2026, the American Institute of CPAs (AICPA) Auditing Standards Board approved Statement on Auditing Standards (SAS) No. 151, “The Auditor’s Responsibilities Relating to Fraud in an Audit of Financial Statements.” The standard supersedes the existing fraud standard in AU-C Section 240 and amends several other auditing standards.

The new standard strengthens requirements related to professional skepticism, fraud risk assessment, documentation, communication, and the auditor’s response when fraud or suspected fraud is identified. Among other changes, auditors will be required to apply a more explicit fraud lens when performing risk assessment procedures and to understand the entity’s whistleblower or other fraud reporting program, including how management and those charged with governance address reported allegations. The standard also requires auditors to determine which types of revenue transactions and assertions give rise to presumed fraud risks involving revenue recognition.

SAS No. 151 does not change management’s and governing officials’ primary responsibility for preventing and detecting fraud. Governments should use the implementation period to evaluate their fraud risk assessments, whistleblower mechanisms, investigation and escalation protocols, documentation, and communication with governing bodies and audit committees. The standard is effective for audits of financial statements for periods ending on or after Dec. 15, 2028, with early implementation permitted.

Revised independence requirements address simultaneous employment

Revisions to the AICPA Code of Professional Conduct addressing simultaneous employment or association with an attest client became effective Sept. 15, 2026. The revisions add a definition of “simultaneously employed or associated” and replace the existing interpretation addressing employment or association with an attest client.

Under the revised guidance, covered members are prohibited from being simultaneously employed by or associated with an attest client. The guidance also restricts partners and professional employees of an accounting firm from holding key positions or serving in governance roles at an attest client. Certain independent contractor and other arrangements may require evaluation under the AICPA’s conceptual framework for independence rather than being automatically prohibited.

The revisions could be relevant when governments use accounting firm personnel in temporary staffing, independent contractor, staff augmentation, advisory, or governance-related roles or when an individual moves between an audit firm and a governmental audit client. Government leaders should discuss potentially affected arrangements with their auditor before engaging firm personnel, clearly define responsibilities, retain all management decisions and oversight, and evaluate whether an arrangement could impair – or appear to impair – auditor independence.

IIA updates guidance on the Three Lines Model and ERM

In July 2026, The Institute of Internal Auditors (IIA) issued two related Statements of Position: an updated “Three Lines Model: Assurance and Advice in Support of Effective Governance” and “The Role of the Internal Audit Function in Enterprise Risk Management.”

The updated Three Lines Model retains its core structure: Management owns and manages risk, specialized second-line functions provide support and oversight, and internal audit provides independent and objective assurance. The update places greater emphasis on coordinating assurance and advisory activities, reducing duplication and coverage gaps, and providing governing bodies with a more integrated view of risk and performance. The ERM paper similarly emphasizes that management remains responsible for risk decisions, even when internal audit provides advice, facilitates risk discussions, or performs other ERM-related activities.

The papers are principles-based and are not mandatory components of The IIA’s International Professional Practices Framework. Nevertheless, governing bodies, senior management, and chief audit executives should consider whether internal audit charters, reporting relationships, assurance maps, and ERM responsibilities clearly distinguish management and internal audit roles. Where responsibilities overlap, safeguards may include governing body approval, disclosure of potential impairments, separation of advisory and assurance work, and independent assurance over activities performed or supervised by internal audit.

IIA updates guidance on interaction with governing bodies

On Sept. 16, 2026, The IIA issued an updated Global Practice Guide, “Interaction With the Board,” and an accompanying “Chief Audit Executive Job Description”. The guide is aligned with Domain III and Principles 6, 7, and 8 of the Global Internal Audit Standards and replaces the original version published in 2011.

The updated guide provides chief audit executives with practical guidance for establishing productive relationships with governing bodies, clarifying accountability among the governing body, senior management, and internal audit, and establishing a consistent cadence for communication. It also addresses board reporting, executive sessions, issue escalation, disagreements with management or the governing body, and the organizational arrangements needed to support internal audit’s independence and effectiveness.

For public sector organizations, The IIA’s use of “board” may encompass a city council, county board or commission, audit committee, board of trustees, group of elected or appointed officials, or another body with authority over relevant governance functions. Because governmental organizations may have multiple governing and oversight bodies, chief audit executives and government leaders should clearly document which body performs the responsibilities assigned to the “board.” They also should evaluate whether internal audit charters and communication protocols provide appropriate access to the governing body, establish responsibilities for oversight of the internal audit function, and define procedures for private sessions and timely escalation of significant risk, control, compliance, and governance matters.