GAGAS 2024 Revision: What Federal Agencies and Auditors Need to Know Before the December 2025 Effective Date

The GAO issued its 2024 revision to Government Auditing Standards — the Yellow Book — and for many federal agencies and audit organizations, the changes are more than procedural updates. They represent a meaningful shift in how audit quality is managed, documented, and evaluated. If your organization hasn't started preparing, the window is closing.

Having spent 17 years conducting audits inside federal agencies — including OMB A-123 assessments at SBA and GAGAS financial audits at the VA — I want to break down what actually matters from a practitioner standpoint, not just what the standard says on paper.

The Biggest Shift: Quality Management Systems

The most significant change in the 2024 revision is the move from quality control to a more robust quality management system (QMS) framework. This isn't just a terminology update — it's a fundamentally different philosophy.

Under the prior standards, audit organizations needed quality control policies and procedures. Under the 2024 revision, organizations must design, implement, and evaluate a system of quality management that is risk-based and tailored to the nature and circumstances of the organization. The eight components of the QMS framework include:

• Risk assessment process — identifying and assessing quality risks
• Governance and leadership — tone at the top and accountability structures
• Relevant ethical requirements — including independence and professional skepticism
• Acceptance and continuance of engagements
• Engagement performance — planning, supervision, review
• Resources — personnel, technology, intellectual resources
• Information and communication — policies being communicated effectively
• Monitoring and remediation — continuous evaluation of the QMS itself

For large federal OIG offices and audit organizations, many of these elements already exist in some form. The challenge is formalizing them into a documented, evaluated system — not just having practices, but being able to demonstrate the system is working.

Independence Requirements: Tightened Language

The 2024 revision tightens and clarifies independence requirements in ways that matter for agency audit shops and firms doing federal work. Key areas to review:

Nonaudit Services and Threat Assessment

The standards provide clearer guidance on when nonaudit services create independence threats and require more documented analysis when an auditor or firm provides both audit and advisory services to the same entity. If your organization or a contracted audit firm is also providing consulting on the systems or programs being audited, that analysis needs to be documented and defensible.

Network Firms

The 2024 revision includes updated guidance on network firms — relevant for federal audit firms operating under common brand, methodology, or revenue-sharing arrangements. The independence evaluation must now consider the network firm structure, not just the engaging firm.

Professional Skepticism: Now Explicitly Required Throughout

Professional skepticism has always been implied in government auditing, but the 2024 revision makes it explicit and pervasive — it's now referenced throughout the standards, not just in the fieldwork sections. This matters because it signals how GAO expects audit organizations to train staff, document judgment calls, and respond when management pushes back on findings.

For agencies receiving audit services, this means expecting more rigorous questioning of documentation, more follow-through on inconsistencies, and auditors who are explicitly required to maintain a questioning mindset even when agency management provides assurances.

Performance Audits: Expanded Criteria Framework

The 2024 revision updates the criteria requirements for performance audits — the type of audit most commonly used to evaluate program effectiveness, efficiency, and economy at federal agencies. Auditors must now be more explicit about selecting, applying, and disclosing the criteria used to evaluate program performance.

This is particularly relevant for agencies subject to DOGE-era scrutiny around program efficiency. Performance audits conducted under the 2024 GAGAS standards will need to show their work more clearly — the criteria chosen, why those criteria were appropriate, and how the evidence was evaluated against them.

What Federal Agencies Should Be Doing Right Now

Whether you're an internal audit shop or an agency that contracts out audit services, here's what the next few months should look like:

• Assess your current quality control documentation against the eight QMS components
• Identify gaps between existing practices and the new QMS requirements
• Update independence policies to reflect the tightened 2024 language
• Confirm your contracted audit firms have updated their engagement letters and quality management systems
• Review nonaudit service arrangements for independence threats under the new criteria
• Begin professional skepticism documentation training for audit staff
• For performance audits starting after December 15, 2025 — apply the 2024 criteria framework from day one

The Bottom Line

The 2024 GAGAS revision isn't a dramatic overhaul — but it does raise the floor on quality management documentation, independence analysis, and professional skepticism in ways that will show up in peer reviews and OIG oversight. The organizations that treat this as a compliance checkbox exercise will find themselves exposed. The ones that use it as an opportunity to genuinely strengthen their audit function will come out ahead.

If you have questions about how the 2024 revision affects your agency's audit program or a federal contracting engagement, reach out directly. This is exactly the kind of work Valley Financial Advisors was built to support.