HHS AERO — The Automated Audit

On May 21, the Department of Health and Human Services (HHS) announced AERO — the Audit Enforcement and Risk Oversight initiative. In plain terms, HHS is now using AI to read five years of Single Audit history across all fifty states, and it has sent letters to every governor and treasurer in the country telling them the results are not good.

The findings behind the announcement are blunt:

• Internal control deficiencies have been left unresolved for five years or more.
• Hundreds of grantees never filed required audits at all, some more than two years delinquent.

HHS's framing is that the audit reports were always there (the findings were "hiding in plain sight") and that what's changed is not the rules but the enforcement. The consequences it's prepared to use are the serious ones: withheld payments, disallowed costs, suspended or terminated awards, and holding back future funding.

What this means if you run on federal dollars

If your organization expends more than $1 million a year in federal awards — SAMHSA grants, State Medicaid contracts, HRSA funding, Head Start, County DMH — you are inside AERO's scope. The review of your Single Audit history is no longer a person with a backlog. It's a system that reads everything, remembers everything, and doesn't get tired.

That changes the economics of a finding. An unresolved finding used to be a line item in a report that might never be re-read. Under AERO, it's a persistent signal attached to your organization — and repeat findings are exactly the pattern the system is built to surface.

The reaction

Not everyone is applauding. Grantee attorneys and stakeholder organizations have raised real questions: the initiative arrived without notice-and-comment rulemaking, and the AI itself is a black box — organizations are told what it concluded, not why, or on what data. Whether an opaque algorithmic finding can support a federal enforcement action is a question that will likely end up in court.

Those concerns matter, and they may reshape how AERO is administered. But notice what nobody is arguing: that the enforcement posture will return to what it was. Whatever the legal process yields, the direction is one-way. Federal oversight is becoming automated, continuous, and pattern-driven. The era of a finding sitting quietly in a filed PDF is over.

Audit-readiness is no longer an annual event

Here's the uncomfortable asymmetry AERO creates: the government now reviews compliance with AI, while most grantees still assemble it by hand — spreadsheets, email threads, and a scramble in the weeks before the auditor arrives. When one side of the table is automated and the other isn't, the manual side tends to lose.

The answer isn't to fear the technology. It's to hold your own records to the same standard the reviewer now does: continuously reconciled, allocation-ready, and defensible on demand.

That is exactly the world Fiscle is built for. Grant compliance that stays current in the background, so that when the letter arrives — and under AERO, letters are arriving — the answer is already in order.

The grantees who treat AERO as a reason to modernize will have, in HHS's own words, a partner. The ones who don't could have serious findings.

— The Fiscle Team

Source: HHS press release, May 21, 2026 — https://www.hhs.gov/press-room/asfr-aero-audit-enforcement-risk-oversight-initiative.html