Grant audit: ISRS 4400 and ISAE 3000 for NGOs and businesses

In Ukraine, grant funds are checked in one of three formats: agreed-upon procedures under ISRS 4400 (Revised), an assurance engagement under ISAE 3000 (Revised), or an audit of the project's financial statements, carried out as a special purpose audit or an audit under GAGAS. The format is set by the donor's grant agreement. For EU grant contracts for external actions, the General Conditions (Annex II) expressly require an expenditure verification report following the Annex VII model. That means agreed-upon procedures: the practitioner reports factual findings, and the contracting authority itself draws conclusions on whether the costs are eligible.

Agreed-upon procedures, assurance or audit: three different engagements

ISRS 4400 (Revised) is effective for agreed-upon procedures engagements whose terms were agreed on or after 1 January 2022. That is how the effective date is stated in the official Ukrainian translation, published by the Ministry of Finance of Ukraine on 24 November 2022 together with other new and revised standards. The engagement itself is straightforward: the practitioner performs procedures agreed with the client and reports factual findings. It provides no assurance, and the practitioner expresses no audit opinion. The standard EU terms of reference say so directly: the expenditure verifier is not required to give an audit opinion, and the contracting authority assesses the reported factual findings and draws its own conclusions from them.

ISAE 3000 (Revised) is effective for assurance reports dated on or after 15 December 2015 (paragraph 9) and covers two levels of assurance, reasonable and limited (paragraph 12(a)(i)). The practitioner must comply with Parts A and B of the IESBA Code as they relate to assurance engagements, or with other professional or legal requirements that are at least as demanding (paragraph 20). The engagement partner must be a member of a firm that applies ISQC 1 or requirements that are at least as demanding (paragraph 31(a)). One of the preconditions for the engagement is that the criteria used to prepare the subject matter information are suitable (paragraph 24(b)(ii)). In a limited assurance engagement, the report must state explicitly that the procedures performed vary in nature and timing from, and are less in extent than, those for a reasonable assurance engagement, and that the level of assurance obtained is substantially lower (paragraph 69(k)).

One important practical point: in agreed-upon procedures, the standard itself does not require the practitioner to be independent. That is why EU contracting authorities add the requirement separately. The standard terms of reference for expenditure verification state plainly that, although ISRS 4400 does not set independence requirements for agreed-upon procedures, the contracting authority requires the expenditure verifier to be independent and to comply with the independence requirements of the IESBA Code of Ethics for Professional Accountants.

Three formats for checking grant funds

When a donor requires a check: current thresholds

The obligation arises from the grant contract; Ukrainian legislation does not impose it. Under the General Conditions for EU grant contracts for external actions (Annex II, Article 15.7), the coordinator must provide an expenditure verification report with any request for further pre-financing for grants above EUR 5,000,000, and with any final report for grants above EUR 100,000. The report must follow the Annex VII model and may be prepared only by an auditor approved or selected by the contracting authority who meets the requirements of the terms of reference in Annex VII.

Horizon Europe works on a different basis. Under the EU Annotated Grant Agreement, a certificate on the financial statements (CFS) is required if the requested EU contribution to costs is EUR 430,000 or more; if a beneficiary that must submit a CFS fails to do so, the maximum EU contribution is capped at EUR 429,999. The certificate itself is based on agreed-upon procedures within the meaning of ISRS 4400 (Revised) and must be issued by a qualified independent external auditor that complies with Directive 2006/43/EC.

In the United States, the Single Audit threshold has been raised from USD 750,000 to USD 1,000,000: under 2 CFR 200.501, an entity that spends USD 1,000,000 or more in federal funds during its fiscal year must have a single audit or a program-specific audit. This version took effect on 1 October 2024.

The US model for foreign organisations is different in substance. The USAID Financial Audit Guide for Foreign Organizations (partial revision of 11 October 2023) requires a financial audit under Generally Accepted Government Auditing Standards (GAGAS, the Yellow Book), with a report on internal control, a report on compliance and a schedule of questioned costs. The threshold in this guide is USD 750,000 of federal funds spent in the recipient's fiscal year.

The Ukrainian legal framework and requirements for the practitioner

Under Article 1(1)(7) of the Law of Ukraine "On the Audit of Financial Statements and Auditing Activities" No. 2258-VIII of 21 December 2017 (as amended on 26 December 2025), audit services are the audit and review of financial statements and consolidated financial statements, other assurance engagements and other professional services provided by audit entities in accordance with International Standards on Auditing. Both agreed-upon procedures and assurance engagements therefore fall within the scope of this Law.

The key restriction is in Article 20(1): audit entities may provide audit services only after registration in the Register of Auditors and Audit Entities. The Register is held and administered by the Audit Public Oversight Body of Ukraine (ОСНАД), which is responsible for creating, operating and maintaining it (Article 20(2)). The Register is public, published and kept up to date on the official ОСНАД website, and the register information is open and freely available around the clock at no charge (Article 20(3)).

This matters in practice for EU donors. The Annex VII terms of reference require the expenditure verifier to meet at least one of several conditions, and one of them is registration as a statutory auditor in the public register of a public oversight body in a third country, provided that register is subject to public oversight principles set out in that country's legislation. The Ukrainian Register administered by ОСНАД meets exactly this condition. The alternative conditions are membership of a national accounting or auditing body that is a member of IFAC, or registration as a statutory auditor in the register of an oversight body in an EU Member State.

On quality management: ISQM 1 has been effective since 15 December 2022, and the Ministry of Finance published its Ukrainian translation on 24 November 2022 together with ISQM 2, ISA 220 and ISRS 4400 (Revised). The text of ISAE 3000 (Revised), however, still refers to ISQC 1 in paragraph 31(a). This discrepancy is worth keeping in mind when a donor template asks for a statement on the quality control system. An audit of the organisation's financial statements is a separate engagement with its own scope and its own report.

What the practitioner checks on an EU grant

The subject of the check is set in Article 15.7 of the General Conditions itself: the auditor examines whether the costs declared by the beneficiaries and the project revenue are real, accurately recorded and eligible under the terms of the contract. The expenditure verification report must cover all costs not covered by any previous expenditure verification report.

The Annex VII model terms of reference (August 2020 version) spell this out in a list of expenditure verification procedures, which are carried out unless they are irrelevant to the particular type of contract:

• the costs were incurred by the entity and relate to it;
• the costs are recorded in the accounting system of the coordinator, the other beneficiaries and affiliated entities in line with the applicable accounting standards and usual cost accounting practices;
• the costs were incurred during the contract's eligibility period (with exceptions for final reports, expenditure verification, audit and evaluation);
• the costs are provided for in the contract budget, the budget ceilings have not been exceeded, and the amount is charged to the correct line of the financial report;
• the costs were necessary to carry out the contract activities, are reasonable and comply with the principle of sound financial management;
• the costs are identifiable and verifiable: supported by adequate documentation (invoices, contracts, purchase orders, payslips, timesheets) and proof of payment, and, where costs are allocated, by a verifiable allocation key;
• the contractual procurement requirements and the rules of nationality and origin have been complied with;
• tax and social security legislation has been complied with (including employer's taxes, pension contributions and social security charges);
• financial support to third parties (sub-grants) is provided for in the contract and does not exceed the contractual limits, and the third parties' costs meet the eligibility requirements;
• other eligibility requirements: recoverable duties and taxes (including VAT) are not included in the report; the correct exchange rates have been applied; any contingency reserve was set up under the contract terms and its use was authorised by the contracting authority; indirect costs do not exceed the maximum contractual percentage; contributions in kind are not included in the financial report; and project revenue has been disclosed and deducted from the declared costs.

This makes a ready-made checklist for a self-review before the engagement begins. In addition, the engagement context questionnaire collects basic information about the contract, including previous audit reports: costs disqualified in the past affect the risk assessment and, as a result, the scope of the new check.

Sampling, materiality and risk

The August 2020 version of the Annex VII terms of reference is built around risk-based sampling. The verifier assesses the inherent risks that the financial report is unreliable, that costs were incurred in breach of the contract terms, that revenue has not been deducted, and the risk of fraud and irregularities. The risk assessment determines the size and structure of the sample, and the result must be clearly described in the verification report.

To determine what counts as a material misstatement or error overall, this version of the terms of reference sets a materiality threshold of 2% of total gross declared costs with a 95% confidence level. The link between the risk assessment and the size and composition of the sample, and the sampling method (statistical or non-statistical), must also be described explicitly in the report.

Report contents and deadlines

Using the expenditure verification report template, including its attached tables, is mandatory. If the check covers financial reports under different contracts, a separate report is prepared for each contract. The report is submitted in English. It must be accompanied by a table of transactions and a table of errors, both in Excel format. The report must contain all of the verifier's financial findings regardless of amount, and the description of each finding must set out the criterion applied (for example, a specific article of the General Conditions of the contract), the facts and the verifier's analysis. Any changes to financial findings between the draft and the final report arising from the consultation procedure must be shown clearly and consistently.

Deadlines under the same model terms of reference: fieldwork or a desk review starts as soon as possible and no later than 15 calendar days after the verification contract is signed or the financial report and supporting documents are provided. The verifier submits the draft report to the coordinator within 10 working days of completing fieldwork; the coordinator's comments are expected within 10 working days; and the final report is issued within 5 working days of receiving the comments. Subcontracting without the coordinator's prior written consent is prohibited.

The US model works differently: the recipient submits final audit reports to the relevant USAID office within 30 days of receiving the report from the audit firm, and no later than nine months after the end of the period audited.

Record retention periods for EU grants are set in Article 16.7 of the General Conditions: beneficiaries keep all records, accounting and supporting documents relating to the contract for five years after payment of the balance, or for three years for grants not exceeding EUR 60,000, and in any case until any ongoing audit, verification, appeal, litigation or pursuit of claims has been concluded.

Common findings that lead a donor to reject costs

According to the European Court of Auditors' annual report for the 2024 financial year, the estimated level of error in EU spending was 3.6% (compared with 5.6% in 2023 and 4.2% in 2022). The main types of quantified errors were ineligible costs and projects, breaches of public procurement rules and missing essential supporting documents. The Court singles out breaches of public procurement, grant award procedures and state aid rules as a separate category of serious errors.

In research programmes the picture is even more specific. The Court found quantified errors in 26 of the 99 research transactions it examined, and errors related to personnel costs, the largest cost item in most research projects, in 24 of the 99. Other quantified errors the Court lists include declaring deductible VAT, ineligible internally invoiced goods and services, costs incurred after the period audited, missing supporting documents and the use of incorrect exchange rates.

In Ukrainian practice the same risks show up as specific document flow defects, and almost all of them map directly onto the procedures listed above: timesheets that are missing or filled in as a formality; no document justifying the key for allocating payroll between projects; an exchange rate other than the one set by the contract; service acceptance certificates that do not describe the actual result; and purchases made without the procedure required by the contract. Most of these risks can be removed before the engagement starts, at the level of the organisation's accounting and internal procedures.

Tax consequences in Ukraine and the international technical assistance regime

For a non-profit organisation the cost of an error is twofold. Under subparagraph 133.4.3 of the Tax Code of Ukraine (ПКУ), if the requirements of paragraph 133.4 are breached, the non-profit organisation must file, within the deadline set for a monthly tax (reporting) period, a report on the use of income (profits) for the period from the start of the year to the last day of the month in which the breach occurred, and state and pay the self-assessed corporate income tax liability. The liability is calculated on the amount of the transactions involving the misuse of assets, and the organisation is removed by the tax authority from the Register of Non-Profit Institutions and Organisations and treated as a corporate income tax payer from the first day of the month following the month of the breach.

Under subparagraph 133.4.4 of the Tax Code, a finding by the tax authority that a non-profit organisation's income was used for purposes other than those set out in subparagraph 133.4.2 is grounds for removing the organisation from the Register of Non-Profit Institutions and Organisations and for assessing corporate income tax, penalties and late payment interest. These are charged from the first day of the month in which the breach occurred.

The international technical assistance regime (МТД) has also changed. The Procedure approved by Cabinet of Ministers Resolution No. 153 of 15 February 2002 applies as amended on 20 May 2026, with the changes made by Cabinet Resolution No. 614 of 13 May 2026. It introduces the concept of a "procurement participant": any person that has a written agreement with a subcontractor and arranges the purchase and import into the customs territory of Ukraine of goods for the recipient using international technical assistance funds. The monitoring requirements have been updated: the implementing party submits to the Secretariat of the Cabinet of Ministers of Ukraine the results of half-year monitoring by 30 July of the reporting year and the results of annual monitoring by 30 January of the following year, in the form set out in Appendix 11 to the Procedure; the results of final monitoring are submitted in the same form.

The effect on tax benefits is direct. State registration of a project is the basis for exercising the right to the relevant benefits, privileges and immunities, and the plan for purchasing goods, works and services in the form set out in Appendix 5 is submitted when there is a need to exercise the right to tax benefits provided for by the legislation and international treaties of Ukraine. If the recipient, beneficiary or implementing party does not submit the monitoring documents, project implementation is deemed unsatisfactory: within 10 days the Secretariat of the Cabinet of Ministers informs the development partner in writing and raises the question of suspending the project until the documents are received. It makes sense to review this area together with a tax audit of the organisation.

Frequently asked questions

What is the difference between ISRS 4400 and ISAE 3000?

Under ISRS 4400, the practitioner performs agreed-upon procedures and reports factual findings without expressing an audit opinion or providing assurance; the client or the contracting authority draws its own conclusions from those findings. Under ISAE 3000, the practitioner provides reasonable or limited assurance (paragraph 12(a)(i)). In agreed-upon procedures the standard itself does not require independence, so the donor adds it as a separate requirement, whereas under ISAE 3000 the practitioner must comply with the IESBA Code as it relates to assurance engagements, or with requirements that are at least as demanding (paragraph 20).

Is an audit mandatory for a civil society organisation in Ukraine?

A mandatory audit of financial statements under Law No. 2258-VIII applies to entities that are required by law to publish such statements, or provide them to users, together with an auditor's report. For checks of grant expenditure, the obligation usually arises from the donor's grant contract: for EU grant contracts for external actions, for example, it is set by Article 15.7 of the General Conditions. The General Conditions of the contract and the terms of reference are therefore the documents to read.

From what grant amount does the EU require an expenditure verification?

Under Annex II to the General Conditions for EU grant contracts (Article 15.7), an expenditure verification report is required with any final report for grants above EUR 100,000 and with any request for further pre-financing for grants above EUR 5,000,000. Horizon Europe has a separate mechanism: a certificate on the financial statements (CFS) is required if the requested EU contribution to costs is EUR 430,000 or more.

Who is authorised to audit grant funds in Ukraine?

Only an audit entity registered in the Register of Auditors and Audit Entities: under Article 20(1) of Law No. 2258-VIII, audit services may be provided only after registration in the Register. The public Register is held and administered by the Audit Public Oversight Body of Ukraine (ОСНАД), and registration in the register of a third-country public oversight body is one of the conditions the Annex VII terms of reference set for an expenditure verifier.

How long does an EU grant expenditure verification take?

Under the August 2020 version of the Annex VII terms of reference, fieldwork or a desk review starts no later than 15 calendar days after the verification contract is signed or the financial report is provided. The draft report is submitted within 10 working days of completing fieldwork, the coordinator's comments are expected within 10 working days, and the final report is issued within 5 working days of receiving the comments.

What should we do if the donor has rejected some of our costs?

First, compare the wording of the finding with the criterion the practitioner relied on, whether an article of the General Conditions or a budget line, and check whether the defect can be cured by providing a document that existed but was not included in the sample. This is exactly why the report template requires the criterion, the facts and the analysis to be described for each finding. If the costs are finally disqualified, a non-profit organisation faces the consequences set out in subparagraphs 133.4.3 and 133.4.4 of the Tax Code.

If your organisation is preparing for a grant expenditure verification, we can help you match the donor's requirements against the standard and assess how ready your documentation is. A good place to start is a consultation.