The OMB Guidance Update Every Federal Agency and Federal Adjacent Organization Should Read
On March 10, 2026, the Office of Management and Budget released an update to its internal control guidance. Most people outside federal financial management won't notice it. If your organization receives federal funding, you should.
Buried in the introduction, OMB Director Russell Vought wrote that OMB has "overly deferred to direction and priorities of external entities whose views are not binding on the Executive Branch." The example given was the Government Accountability Office.
That sentence matters more than it looks.
GAO sets the standards. Everyone else follows.
GAO issues the Standards for Internal Control in the Federal Government, known as the Green Book. It defines what a functioning internal control environment looks like for federal agencies, nonprofits, and contractors that receive or manage federal funds. Alongside it, GAO issues the Government Auditing Standards, known as the Yellow Book, which governs how auditors evaluate those controls under Uniform Guidance. The two documents work together. You can't fully understand one without the other.
These aren't advisory documents. If you've been through a Uniform Guidance audit under 2 CFR 200, your auditor was working from the Yellow Book. Your internal control assessment referenced the Green Book. The entire accountability structure for federal funding traces back to standards that GAO has developed and maintained for decades.
Whether this signals a broader shift in the administration's view of GAO's role or reflects a narrower policy disagreement is still unfolding. What's clear is that the language puts the relationship between OMB and GAO standards in a different place than it's been.
What this doesn't mean.
This guidance update doesn't eliminate the Green Book or the Yellow Book. It doesn't change your Single Audit requirements today. Organizations subject to 2 CFR 200 still operate under Uniform Guidance, and that guidance still references GAO standards.
What it does is introduce real ambiguity about the long-term authority of those standards. For organizations that rely on them as a stable compliance baseline, the practical question is what happens next as that relationship gets sorted out.
What this does mean.
Organizations that built internal controls because the work required them will not be destabilized by this. If your control environment is documented, tested, and running as designed, a shift in guidance authority changes the backdrop, not your compliance posture.
The organizations at risk are the ones whose controls exist primarily on paper. Where the policy says one thing and the operation does another. Where the last internal control update happened because an auditor asked, not because the organization actually runs that way.
Those organizations were already exposed. This guidance makes exposure harder to manage.
What to do now.
You don't need to wait for OMB to finalize its position before figuring out where you stand. The useful questions right now are operational, not regulatory.
Do your internal controls reflect how your organization actually works, or how it worked two years ago? Have you tested them under real pressure, or only during audit prep? If your auditor changed their interpretation of the standards tomorrow, would your documentation hold?
If any of those produce hesitation, that's where the work is.
The compliance environment for federal funding is shifting. Organizations that know their actual internal control posture, not just their audited one, will be in a much better position for what comes next.
atisha.burks@anchorpointrising.com
Sources: OMB Circular A-123, Management's Responsibility for Enterprise Risk Management and Internal Control (March 2026 update); GAO-14-704G, Standards for Internal Control in the Federal Government (Green Book); GAO Government Auditing Standards (Yellow Book, 2018 revision); Government Executive, "Vought Takes Aim at GAO in New Guidance," March 13, 2026.
