Requirements & evidence
GAO FISCAM
The federal audit methodology for assessing the design, implementation, and operating effectiveness of information-system controls under generally accepted government auditing standards. It is audit guidance, not an agency authorization or certification.
- Edition on record
- June 2026 (GAO-26-108633)
- Issuing authority
- US Government Accountability Office and CIGIE (opens in a new tab)
- Edition published
- Source last checked
Understand the scope
What the framework covers.
The library records this framework for federal, government audit, public sector, across US. The issuing authority determines applicability; your assessment scope should identify the organization, systems, services, and edition being assessed.
Areas of requirement
- Entitywide controls
- Access controls
- Configuration management
- Segregation of duties
- Contingency planning
- Business-process controls
The library tracks the authority and edition. A normalized requirement catalog is not available for this framework, so a requirement count is not stated here.
Source access and licensing
GAO publishes the manual plus framework and crosswalk workbooks; pin the June 2026 release before normalization.
Prepare with context
The evidence behind
the requirements.
Evidence needs to demonstrate how a requirement is met within the assessment scope. Keep the source requirement, collection context, responsible owner, review decision, and period of applicability together.
A framework-specific collection workflow has not been activated. The reference material on this page can inform scoping and preparation; it does not establish evidence collection or assessment readiness.
ControlFrame availability
Framework reference available
Authority and version facts, with a parsed public catalog when available; no tenant blueprint or executable evidence method is activated.
How availability is determined
GAO FISCAM is tracked in the registry — authority, version ledger, verification — and nothing else is modelled for it yet. Import its catalog to begin.
Catalog status: Planned. Tracked metadata: we record the regime and its issuing authority for review. Registry presence does not mean automated monitoring is active. No control or requirement model is implemented.
Metadata only; the public FISCAM framework and audit procedures are not ingested, normalized, or released as a product module.
Follow the source
Editions and transitions.
These are the editions recorded in the library, checked August 28, 2026. Confirm the applicable edition with the authority before beginning an assessment.
Announced transition
The June 2026 revision is already effective for fiscal-year and calendar-year 2026 federal financial statement audits; it becomes effective for attestation and performance-audit engagements beginning on or after 2026-10-01.
Authority’s stated timing: 2026-10-01 for attestation and performance audits
Read the authority’s announcement (opens in a new tab)- June 2026 (GAO-26-108633)Current edition on record · Replaces September 2024 (GAO-24-107026)
- September 2024 (GAO-24-107026)Superseded edition
Recorded change history
· GAO FISCAM: The June 2026 revision is already effective for fiscal-year and calendar-year 2026 federal financial statement audits; it becomes effective for attestation and performance-audit engagements beginning on or after 2026-10-01.
· GAO FISCAM June 2026 (GAO-26-108633) supersedes September 2024 (GAO-24-107026) and is the current edition.
Check the basis
Sources you can follow.
Verified against the issuing authority’s own publication. Source verification was recorded on August 28, 2026.
- US Government Accountability Office and CIGIE (opens in a new tab)
Issuing authority and framework publication.
- Edition reference: June 2026 (GAO-26-108633) (opens in a new tab)
The publication used to establish the recorded edition.
Catalog provenance and record details
Framework record: gao-fiscam-2026.
Source artifact: acquisition required.
Parsed catalog: Not ingested.
Control families as published: Entitywide controls · Access controls · Configuration management · Segregation of duties · Contingency planning · Business-process controls.
Record last updated: August 28, 2026.
Common questions
A closer look.
What is GAO FISCAM?
The federal audit methodology for assessing the design, implementation, and operating effectiveness of information-system controls under generally accepted government auditing standards. It is audit guidance, not an agency authorization or certification.
Who does GAO FISCAM apply to?
GAO FISCAM applies to federal, government audit, public sector, US, per US Government Accountability Office and CIGIE.
What is the current version of GAO FISCAM?
The current edition is June 2026 (GAO-26-108633), issued by US Government Accountability Office and CIGIE and published 2026-06-29. Source: https://www.gao.gov/products/gao-26-108633.
What does an assessment under GAO FISCAM require?
No control catalog has been ingested for GAO FISCAM yet — the registry tracks it as planned (Tracked metadata: we record the regime and its issuing authority for review. Registry presence does not mean automated monitoring is active. No control or requirement model is implemented), so an assessment under this framework currently requires the authority's own catalog rather than a ControlFrame-parsed one.
At a glance
GAO FISCAM
June 2026 (GAO-26-108633)
- Framework reference
- Authority and edition tracked
- Evidence preparation
- Framework reference available
- Source confidence
- Primary authority
A framework reference describes requirements. Evidence decisions belong to a scoped assessment and a named reviewer.
Make the requirements
part of the work.
Explore how ControlFrame can organize GAO FISCAM requirements, evidence preparation, and review for your assessment scope.