Cross-References:Published documentation hub (audited 2026-04-18):
- REGULATORY_COMPLIANCE_TRACKER.md — FA section and status legend
docs/compliance/AUTHORITATIVE_REFERENCES.md— Authoritative External References (Finance & Accounting Compliance)- FA-10 Tax Reporting & Compliance
- FA-23 Financial Statement Customization (ASC 958)
- FA-25 Financial Audit Trail & Compliance Reports
- FA-13 Project Accounting & Grant Tracking
- Latest deep review:
specs/fa/reports/fa-deep-review-20260417.md— companion: actionsProposed specs to close named gaps in this tracker (from 2026-04-17 deep review):
- End-user / admin guides:
packages/docs/docs/finance/(32 user + 20 admin + 15 planned, with cross-links to the controls below)- Developer reference:
packages/docs/docs/developer/fa/(architecture, hooks, services, events, schema, edge-functions, security-model)- Security & compliance hub (this tracker’s user-facing companion):
packages/docs/docs/security-compliance/fa/
- Overview
- Internal Controls — append-only ledger / period close / SoD
- IRS Tax Reporting — companion to §1
- GAAP / ASC 958 — companion to §2
- OMB 2 CFR 200 Grants — companion to §3
- Vendor Data Handling — financial PII (W-9 / SSN / EIN / NACHA / Plaid tokens)
- PCI-DSS — current posture + FA-32 roadmap
- Role Matrix — PF-30 permission keys × roles
- RLS Catalog —
fa_*table RLS posture- Audit Logs — companion to §4.1
- FA-36 Federal Financial Reporting (FFR / SF-425, SEFA, Single Audit) — closes §3.2 + §3.3 (”⏳ Not Started — No spec”). Preview:
/docs/finance/planned/federal-financial-reporting.- FA-37 Subrecipient & Vendor Compliance (SAM.gov / OFAC / W-9) — closes §3.5 (”⏳ Not Started”). Preview:
/docs/finance/planned/subrecipient-vendor-compliance.- FA-38 ASC 842 Lease Accounting — closes the “ASC 842 absent” gap noted in deep review Part 5. Preview:
/docs/finance/planned/asc-842-lease-accounting.- FA-39 Bill Pay & Vendor Payment Rails (Bill.com / Mercury) — supports NACHA + check + wire end-to-end. Preview:
/docs/finance/planned/bill-pay-vendor-rails.- FA-40 Multi-State Payroll Tax Withholding (PF-96-aligned) — closes §1.2 multi-state row. Preview:
/docs/finance/planned/multi-state-payroll.- FA-EN-14 SoD Report + Auditor Export Bundle — closes §4.1 (SoD report and auditor export, ”⏳ Not Started”).
Overview
This document tracks Finance & Accounting (FA) regulatory compliance: IRS tax reporting, GAAP/FASB ASC 958 nonprofit reporting, OMB Uniform Guidance (grant compliance), and financial internal controls. Status and interim procedures are summarized in the main REGULATORY_COMPLIANCE_TRACKER.md; this document provides detailed requirements and authoritative references.1. IRS Tax Reporting Compliance
Federal and state tax form generation and filing obligations supported by FA-10 (Tax Reporting & Compliance). FA-10 integrates with HR-07 (Payroll) for W-2 and 941/940 data.1.1 Information Returns (1099-MISC / 1099-NEC)
1.2 Wage and Payroll Tax (W-2, 941, 940)
1.3 Out of Scope (per FA-10)
- Form 990 (annual information return for nonprofits) — Handled by external CPA. Filing thresholds: Form 990-N (gross receipts ≤ 200K and assets < 200K or assets ≥ $500K). FA-23 supports functional expense categorization (Program Services, G&A, Fundraising) for 990 input; return preparation remains external.
- Form 990-T / Arizona Form 99T (unrelated business income) — If unrelated business income is ≥ $1,000, file 990-T (federal) and Arizona Form 99T; out of scope for FA-10; handle externally.
- Form 1040 / corporate tax returns — Prepared externally.
2. GAAP / FASB ASC 958 Compliance
Nonprofit financial reporting standards. Behavioral health and recovery housing organizations typically report under FASB ASC 958 (Not-for-Profit Entities).2.1 Financial Statements
2.2 Fund Accounting
3. Grant Compliance (OMB Uniform Guidance — 2 CFR 200)
Federal grant recipients must comply with 2 CFR 200 (Uniform Administrative Requirements, Cost Principles, and Audit Requirements). FA-13 (Project Accounting & Grant Tracking) and FA-15 (Cost Allocation & Indirect Cost Rates) provide system support when implemented.3.1 Allowable Costs and Cost Principles
3.2 Single Audit (2 CFR 200 Subpart F)
3.3 Federal Financial Report (FFR/SF-425)
Federal grant recipients (e.g. SAMHSA, other federal awardees) must submit the Federal Financial Report (FFR, SF-425) via the Payment Management System (PMS).
Interim: Prepare FFR from grant/project and GL data manually; submit via PMS. Implement FA-13 (Project Accounting & Grant Tracking) to improve data availability for FFR.
3.4 Record retention (2 CFR 200.334)
Recipients and subrecipients must retain federal award records for 3 years from the date of submission of the final financial report (2 CFR 200.334). Records must be retained longer if litigation, claims, or audit findings exist until resolution. Alignment: FA-SECURITY-CONSIDERATIONS.md requires audit logs to be retained for 7 years, which satisfies and exceeds 2 CFR 200.334 for financial and compliance records. No additional tracker row required. Reference: eCFR 2 CFR 200.334 — Retention requirements for records.3.5 Subrecipient monitoring (pass-through entities)
Under 2 CFR 200.331–200.332, pass-through entities must verify that subrecipients are not excluded (e.g. via SAM.gov), and ensure each subaward is clearly identified and documented (federal award id, subrecipient name/UEI, and other required information).
Interim: If the organization passes federal funds to subrecipients: perform SAM.gov exclusion checks and maintain subaward documentation outside the system until a dedicated spec exists (future FA or GR).
4. Financial Controls & Audit Readiness
Internal controls and audit trail support for external audits and SOX-analogous expectations (segregation of duties, immutable audit trail). State and local — Arizona: Arizona nonprofits must file an Annual Report with the Arizona Corporation Commission by the formation anniversary date (ARS 10-11622). Content includes directors/officers, principal office, activities, certificate of disclosure, and a statement that all corporate income tax returns have been filed. Extension up to 6 months available. No system automation; use org profile/board data. See Authoritative External References: Arizona Corporation Commission, ARS 10-11622.4.1 Audit Trail and Reporting
4.2 Period and Close Controls
4.3 Access and Security
- FA security: FA-SECURITY-CONSIDERATIONS.md — Audit logs retained 7 years; permission-gated access to tax and financial data.
- HR offboarding: Financial system access revoked on termination per SOX-related controls (see HR_IT_OFFBOARDING.md).
5. Authoritative External References
Use these sources for implementation and spec review. Full table also indocs/compliance/AUTHORITATIVE_REFERENCES.md (Finance & Accounting Compliance).
Version History
1.1.0 (2026-02-27)
- Added Federal Financial Report (FFR/SF-425) subsection and tracker row; SAMHSA FFR authoritative reference.
- Added 2 CFR 200.334 record retention subsection and alignment with 7-year policy.
- Added subrecipient monitoring (2 CFR 200.331–332) subsection; added pass-through branch to AGENTS.md decision tree.
- Expanded Arizona ACC annual report in tracker and state/local note; added ARS 10-11622 reference.
- Expanded Form 990 thresholds (990-N, 990-EZ, 990) and 990-T/AZ 99T in Out of scope.
1.0.0 (2026-02-27)
- Initial FA financial compliance tracking document
- IRS tax reporting (1099, W-2, 941, 940) per FA-10
- GAAP/FASB ASC 958 and fund accounting per FA-01, FA-02, FA-23, FA-07
- Grant compliance (OMB 2 CFR 200) and Single Audit per FA-13, FA-15
- Financial controls and audit readiness per FA-25, FA-19
- Authoritative external references aligned with AGENTS.md
Last Updated: 2026-04-18 Next Review: 2026-05-27