What does a donor audit look at?
A donor audit checks whether grant money was spent as the agreement allows, and whether your records can prove it. The exact scope comes from the grant agreement and the audit terms of reference. Laws and donor rules differ, so always read yours.
Most audits test the same areas:
- Costs. Are they allowed, in the budget, and in the grant period?
- Evidence. Is there an invoice, an approval and proof the goods or work arrived?
- Procurement. Did you follow the rules for quotations and competition?
- Staff costs. Do timesheets or other records support charges to the grant?
- Reporting. Do reported figures match the ledger?
What should you do first?
- Read the grant agreement. Note allowed and disallowed costs, thresholds, reporting dates and any record-keeping period.
- Read the terms of reference. Note the period, the grants and the sample size, if stated.
- Name an audit coordinator. One person receives requests, tracks them and keeps a log.
- Tell staff. Program, logistics, HR and finance staff may all receive questions.
How do you gather and organize evidence?
Build a folder, physical or digital, for each grant. Inside, organize by transaction, not by document type. For each transaction, the folder should answer: what, how much, who approved, who received, and how it was paid.
A checklist for one purchase:
- Approved request or purchase order.
- Quotations, where your policy requires them.
- Contract or agreement, if any.
- Goods received note or delivery proof.
- Supplier invoice.
- Payment approval and bank payment record.
- Ledger entry showing the project, grant and budget line.
Staff costs need a similar chain: contract, timesheet or time record, approval and the ledger entry. See how to charge staff time to projects.
How do you run your own pre-audit check?
Do the auditor’s job first. It is the cheapest way to find gaps.
- Pull a sample from the ledger. Take a mix of large, small and unusual transactions.
- For each, try to assemble the evidence chain above.
- Check that approvals follow your limits and that no one approved their own request.
- Compare reported totals in the donor report with ledger totals.
- Check the cost was in the period and allowed under the agreement.
- List every gap, with an owner and a date.
Fix what can be fixed honestly. Missing signatures cannot be added later, and documents must never be recreated or backdated. For gaps you cannot close, write a short, factual note: what happened, why, and what changed.
Our article on budget vs actual review helps you catch problems in the figures before the audit.
How should you work with the auditor?
- One contact. Requests and answers go through the audit coordinator.
- A request log. Record the date, the question, who answered and what was sent.
- Answer the question asked. Send the document, not an essay.
- Say when you do not know. Promise a date, then meet it.
- Brief staff. People should know what to expect and tell the truth.
If the auditor needs ongoing access to records, give it in a controlled way: limited to the grant and period, read-only, and logged.
What happens after the audit?
Read the draft findings carefully. Correct factual errors with evidence. For each finding, write a management response with an owner, an action and a date. Track the actions to the end, and check them again before the next audit. A repeated finding is usually judged more harshly than a new one.
Where EMPOBase fits
EMPOBase keeps the chain together: approvals record who acted and when, entries post to a project, grant and budget line, and records can be traced back to the request. External Access lets you invite an auditor to a scoped, read-only, logged review workspace, with the access window, data period and project scope that you set. A complete bundled evidence pack is not guaranteed, so check what is available before the review. The workspace does not establish donor or statutory compliance. That judgment stays with you and the auditor. See External Access in the docs or talk to us.