The 2025 GAO Green Book Has Arrived: The Biggest Internal Control Update in More Than a Decade

For more than a decade, federal agencies, state and local governments, government contractors, and nonprofit organizations have relied on the GAO Standards for Internal Control in the Federal Government, commonly known as the Green Book, as the foundation for building effective internal control systems.

In May 2025, the U.S. Government Accountability Office (GAO) released the first major revision since 2014. The updated Green Book became effective beginning with Fiscal Year 2026 and reflects today's rapidly changing risk environment.

While the framework still consists of five components and 17 principles, the 2025 edition significantly strengthens management's responsibilities in several critical areas.

Internal Control Has Become More Than Financial Controls

Historically, organizations viewed internal control primarily as a financial reporting function.

The 2025 Green Book reinforces that internal control is an enterprise-wide management responsibility designed to help organizations achieve operational, reporting, and compliance objectives.

The revised guidance recognizes that today's organizations face risks that barely existed when the 2014 edition was published, including:

• Cybersecurity threats

• Artificial intelligence and emerging technologies

• Improper payments

• Fraud schemes

• Third-party and vendor risks

• Rapid organizational change

• Emergency response programs

The message is clear: internal controls must evolve as risks evolve. 

Five Major Improvements in the 2025 Green Book

1. Greater Focus on Fraud Prevention

The updated Green Book requires management to explicitly identify, assess, and respond to fraud risks as part of its overall risk assessment.

Rather than treating fraud as solely an audit issue, organizations are expected to build preventive controls directly into business processes.

This shifts the focus from detecting fraud after losses occur to preventing fraud before it happens.

2. Information Security Is Now a Core Internal Control Issue

Cybersecurity is no longer viewed as simply an IT responsibility.

The revised standards require management to consider information security risks when identifying, analyzing, and responding to organizational risks.

As cyber threats continue to grow, organizations must ensure that technology controls are integrated into their internal control systems rather than operating independently.

3. Stronger Documentation Requirements

One of the most significant changes is the expanded emphasis on documentation.

Management is now expected to document:

• Risk assessments

• Risk responses

• Control design

• Control implementation

• Monitoring activities

• Significant changes

• Corrective actions

If an organization cannot demonstrate that a control was designed, implemented, and operating effectively, it becomes much more difficult to conclude that the control is functioning as intended.

4. Managing Significant Organizational Changes

Organizations constantly adapt to new technology, new regulations, reorganizations, staffing changes, and emergency programs.

The Green Book now requires management to establish a documented process for identifying, analyzing, and responding to risks arising from significant changes.

This helps ensure that internal controls evolve alongside the organization rather than becoming outdated.

5. Preventive Controls Take Center Stage

The 2025 revision emphasizes designing preventive controls wherever practical instead of relying primarily on detective controls.

Preventive controls—such as segregation of duties, approval workflows, automated validation rules, and system access restrictions—reduce the likelihood that errors or fraud occur in the first place.

This reflects a proactive approach to governance that is generally less costly and more effective than correcting problems after they occur.

What This Means for Auditors

The revised Green Book reinforces a principle that has always been true:

Management owns internal control. Auditors evaluate it.

Internal auditors, Inspectors General, external auditors, and compliance professionals will increasingly assess whether management has:

• Identified significant risks.

• Designed appropriate controls.

• Implemented those controls.

• Retained evidence that controls operate.

• Evaluated deficiencies.

• Monitored corrective actions.

Organizations that continue to treat internal control as a year-end compliance exercise may find themselves falling behind.

Why Organizations Should Act Now

The Green Book applies directly to federal agencies and is widely adopted by:

• State governments

• Local governments

• Government contractors

• Nonprofit organizations

• Public authorities

• Educational institutions

Many organizations that already follow COSO will find the updated Green Book complements their governance framework while providing more detailed implementation guidance for public-sector operations.

The Bottom Line

The 2025 Green Book is much more than an update to an auditing manual.

It is a modernization of how organizations should design, implement, monitor, and continuously improve internal controls in an environment shaped by fraud, cyber threats, emerging technologies, and increasing public accountability.

Organizations that begin aligning with the revised standards now will be better positioned to strengthen governance, reduce operational risk, and demonstrate sound stewardship of public resources.

As management guru W. Edwards Deming observed decades ago, "Quality is everyone's responsibility." The 2025 Green Book extends that philosophy to internal control—making it clear that accountability, risk management, and effective controls are responsibilities shared across the entire organization, not just the audit department.