Higher education institutions do not face one audit. Public institutions face an annual GASB financial statement audit, a Single Audit if federal expenditures cross the threshold, and an accreditation review that itself has a mandatory mid-cycle check, not just the reaffirmation visit everyone remembers.
Accreditors do not wait a full decade to look again. SACSCOC requires a Fifth-Year Interim Report roughly halfway through the reaffirmation cycle, which means an institution treating accreditation evidence as a once-a-decade project is already behind on a checkpoint most departments have forgotten exists.
The difference between audit-scrambling and audit-ready is not effort. It is whether evidence gets produced as a byproduct of normal operations or reconstructed from scratch under deadline pressure every time a review is announced.
Ask a provost's office what "the audit" refers to, and the answer usually depends on which office is asking. Finance means the annual financial statement audit. Research administration means the Single Audit that comes with crossing a federal expenditure threshold. Institutional effectiveness means the accreditation review, tested against standards like SACSCOC's integrity requirement or HLC's Criterion 2.
Each of these runs on its own cycle, its own evidence requirements, and often its own office, which is exactly why an institution can be well prepared for one and genuinely caught off guard by another. Audit readiness that only covers one of these is not institutional readiness. It is departmental readiness mistaken for the whole picture.
Public colleges and universities report their financial statements under a specific model. GASB Statement No. 35 extended the reporting framework established in GASB Statement No. 34 to public colleges and universities, requiring management's discussion and analysis, basic financial statements, notes, and required supplementary information, reported annually regardless of whether the institution's federal spending ever crosses the Single Audit threshold.
This annual financial statement audit happens every year on its own schedule, independent of federal award activity, and institutions that build their audit-readiness process entirely around the Single Audit's federal expenditure trigger are missing the audit that happens whether or not that threshold is ever crossed at all.
Reaffirmation feels distant enough that institutions can treat evidence gathering as a project to start when the visit is finally scheduled. SACSCOC's Fifth-Year Interim Report requirement exists specifically because the Department of Education requires accreditors to monitor institutions more often than once a decade, and it lands roughly halfway through the reaffirmation cycle, testing compliance with a selected set of standards and, historically, an impact report on the institution's Quality Enhancement Plan, a QEP requirement SACSCOC placed under a study period in 2025 pending a decision on whether to retain it.
An institution that treats accreditation as a ten-year clock, rather than a cycle with a real mid-point checkpoint, is planning against the wrong calendar, and a Fifth-Year finding that triggers a monitoring report starts a two-year clock the institution did not budget time for.
Continuous readiness is not a bigger binder. It is a change in when evidence gets created relative to when it gets requested. In a scrambling institution, evidence is reconstructed after an audit or review is announced: emails get searched, spreadsheets get assembled, people get asked to remember what happened months or years earlier. In a continuously ready institution, the same evidence, an internal control record, a policy exception's documented rationale, a committee's meeting minutes, is captured the moment the underlying event happens, so producing it later is a retrieval task, not a reconstruction project.
The internal control expectation under 2 CFR 200.303 applies to federal award recipients specifically, but the underlying discipline, capture evidence as a byproduct of the work rather than after the fact, is the same discipline every audit type ultimately tests.
|
Review type |
Cadence |
What has to be continuously current |
|
GASB financial statement audit |
Annual, for public institutions |
Financial statements, notes, and supplementary information under GASB 35 |
|
Single Audit |
Any year federal expenditures cross the threshold |
Internal controls, cost allowability, and corrective action documentation |
|
Accreditation reaffirmation |
Roughly every ten years, varies by accreditor |
Full evidence set across every relevant standard |
|
Accreditation mid-cycle check |
Roughly the midpoint of the reaffirmation cycle |
Selected standards plus, historically, Quality Enhancement Plan impact evidence |
A policy decision, a control record, or a governance action is tagged to the review it will eventually support, whether that is the annual financial audit, a Single Audit, or accreditation, rather than filed generically and sorted out later.
Finance, research administration, and institutional effectiveness each generate evidence relevant to different audits, and continuous readiness depends on being able to retrieve any of it without depending on which office happens to still have the original file.
The Fifth-Year Interim Report date, the next Single Audit threshold check, and the annual financial statement audit schedule are all tracked against actual calendar dates, not treated as someday obligations.
Segregation of duties records, approval trails, and policy exception documentation are captured as the underlying events happen, so a control test during any audit type can be answered from existing records.
The institution can see which standards or controls currently lack current supporting evidence, closing gaps proactively rather than discovering them during fieldwork.
Records are retained on the specific schedule each review type requires, GASB, Single Audit, or accreditation, rather than a single generic retention policy, mirroring the same three-year minimum federal award records already require.
Kissflow is the governed execution layer at the edges of the audit readiness stack. It does not replace the external financial auditor, the Single Audit process, or the accreditation review itself. It replaces the scramble that happens when evidence for any of these has to be reconstructed from scattered offices and individual memory under deadline pressure.
If your institution runs Banner, Workday, or a dedicated accreditation management platform, Kissflow does not compete with any of them for their specific function. It sits alongside them as the layer that ties evidence to the audit or review it supports at the moment that evidence is created, so retrieval later is fast regardless of which of the institution's several audit cycles is asking.
The differentiation that matters to a provost's office: when a new accreditation standard applies, a Fifth-Year Interim Report deadline approaches, or the institution crosses the Single Audit threshold for the first time, the office coordinating institutional readiness updates the tracking directly, instead of launching a new evidence-gathering project each time a different audit type comes due.
The Single Audit only triggers once federal expenditures cross the federal threshold in a given year, set at $1 million for fiscal years beginning on or after 1 October 2024. The GASB-governed financial statement audit happens annually regardless, which is why treating Single Audit readiness as the whole picture misses the audit that happens every year either way.
It is a mid-cycle compliance check SACSCOC requires roughly halfway through an institution's reaffirmation cycle, covering selected standards and the institution's Quality Enhancement Plan. A finding of non-compliance can trigger a two-year monitoring period the institution has to plan for.
Not the amount of evidence, but when it gets created. Scrambling reconstructs evidence after a review is announced. Continuous readiness captures the same evidence as a byproduct of normal operations, so producing it later is retrieval, not reconstruction.
Some evidence overlaps, internal controls and governance records in particular, but each audit type also has its own specific requirements. GASB financial statements, Single Audit cost documentation, and accreditation standard evidence are not interchangeable, even where the underlying discipline behind producing them is the same.
It depends on the specific requirement: federal award records generally require a minimum multi-year retention period, while accreditation evidence is typically expected to be available across the full reaffirmation cycle. Institutions should track retention against the strictest applicable requirement, not a single generic policy.
No. Kissflow is the workflow layer that ties evidence to the audit or review it supports and keeps it retrievable continuously. The external audit relationship and the institution's own accreditation liaison role remain exactly where they are.
Request a 30-minute walkthrough to see how Kissflow keeps evidence for financial statement audits, Single Audits, and accreditation reviews continuously current.