Grant Management
Nonprofit Management
Subrecipient Monitoring: Requirements, Risk Assessments and Tracking Tools
Last updated: October 9, 2026 · Independent guide · We do not sell rankings or coverage.
Subrecipient monitoring is the set of checks a pass-through entity must perform when it passes federal funds to another organization to carry out part of a federal award. Under 2 CFR 200.332, as revised in 2024, you must screen each subrecipient for exclusion, issue a subaward with the required federal data elements, evaluate its fraud and noncompliance risk, monitor its reports, confirm it is audited when required and issue management decisions on findings that affect your subaward. Your own Single Audit tests all of this under Section M of the OMB Compliance Supplement.
The subrecipient monitoring process in eight stages
- Classify the relationship as a subaward or a procurement contract.
- Screen and assess risk before you sign.
- Issue the subaward with every required data element, and report it under FFATA.
- Set the monitoring plan and any specific conditions.
- Monitor during performance: reports, invoices and significant developments.
- Verify audits and pull reports from the Federal Audit Clearinghouse (FAC).
- Issue management decisions and track corrective action.
- Enforce, adjust records and close out.
A typical split of duties:
| Stage | Responsible | Approves or consulted | Evidence an auditor asks for |
|---|---|---|---|
| 1. Classification | Grants officer | Program manager or PI consulted | Signed determination checklist |
| 2. Screening and risk | Grants officer | Grants manager approves rating | Dated SAM.gov result, scored assessment |
| 3. Subaward issuance | Grants or contracts officer | Authorized signatory | Executed agreement, FFATA report |
| 4. Monitoring plan | Grants officer | Grants manager | Written plan tied to the rating |
| 5. Ongoing monitoring | Program manager, grant accountant | Grants manager | Invoice sign-offs, desk and site visit reports |
| 6. Audit verification | Grants compliance staff | Controller | Audit tracking log, FAC reports |
| 7. Management decisions | Grants compliance staff | Controller or CFO signs | Dated decision letters |
| 8. Enforcement and closeout | Grants officer, grant accountant | Grants manager | Final reports, closeout letter |
Stage 1: Decide whether the recipient is a subrecipient or a contractor
The grants officer makes this call case by case from the scope of work and budget, and files a written determination. Under 2 CFR 200.331, the substance of the relationship matters more than the form of the agreement, and no single factor decides it.
An entity looks like a subrecipient when it determines eligibility for assistance, has its performance measured against federal program objectives, makes programmatic decisions, must follow federal program requirements and carries out a public purpose. It looks like a contractor when it provides the goods or services in its normal business, sells to many purchasers in a competitive market, provides something ancillary to the program and is not subject to the program’s compliance requirements.
What goes wrong. Agreements get labelled by the partner’s type rather than the work. Payments a contractor receives for goods or services are not subject to audit under Subpart F, while federal awards expended as a subrecipient are (2 CFR 200.501(g)).
Stage 2: Screen the subrecipient and evaluate its risk
Before you obligate funds, confirm the entity is not excluded under 2 CFR 180.300; a SAM.gov check is one accepted method (2 CFR 200.332(a)).
The 2024 revision requires you to evaluate fraud risk as well as noncompliance risk (OMB, 89 FR 30046, April 22, 2024). You should consider prior experience with similar subawards, prior audit results, new personnel or substantially changed systems, and the results of any federal agency monitoring. State tools add financial stability, accounting systems and written internal controls (Colorado Office of the State Controller, no date shown).
Illustration only. A simple model scores each factor 0 to 2 and sums the scores:
| Score (illustrative) | Rating | Monitoring response |
|---|---|---|
| 0 to 4 | Low | Quarterly reports, sampled invoice backup, annual audit check |
| 5 to 9 | Medium | Backup on every invoice, annual desk review, technical assistance |
| 10 or more | High | Reimbursement only, monthly reporting, site visit |
What goes wrong. The rating is filed but nothing changes. Eide Bailly, a CPA firm, lists ratings with no effect on oversight as a common misstep (Eide Bailly, August 12, 2020). Reassess at each amendment.
Stage 3: Issue the subaward with the required data elements
The subaward must be clearly identified as a subaward and include the elements in 2 CFR 200.332(b)(1). If some are not yet available, give the best available information and supply the rest when you have it.
| Required data element | Citation |
|---|---|
| Subrecipient name (matching its UEI record) and unique entity identifier | (b)(1)(i) and (ii) |
| FAIN and Federal Award Date | (b)(1)(iii) and (iv) |
| Subaward period of performance and budget period dates | (b)(1)(v) and (vi) |
| Federal funds obligated in this action, total obligated, and total committed | (b)(1)(vii) to (ix) |
| FFATA project description; federal agency, pass-through entity and awarding official contact | (b)(1)(x) and (xi) |
| Assistance Listings title and number, with dollars by listing at disbursement | (b)(1)(xii) |
| Research and development flag; indirect cost rate, including de minimis use | (b)(1)(xiii) and (xiv) |
The agreement must also flow down federal and award requirements, any extra requirements you impose (including the 200.415(b) certification on payment requests and financial reports), records access for you and auditors, and closeout terms. If the subrecipient has a federally negotiated indirect rate, you cannot require the de minimis rate instead. Our guide to the de minimis indirect cost rate covers the rate of up to 15% and the first $50,000 of each subaward that counts in the MTDC base.
Report each first-tier subaward of $30,000 or more by the end of the following month (2 CFR 170, Appendix A). The text still names FSRS, but GSA retired FSRS.gov on March 6, 2025 and moved subaward reporting into SAM.gov (Forvis Mazars, March 7, 2025). Fixed amount subawards are allowed up to $500,000 with prior written approval from the federal agency (2 CFR 200.333), double the prior threshold of $250,000 (LSU Health New Orleans, October 2024).
What goes wrong. Templates omit the R&D flag, and amendments go out without updated obligation figures.
Stage 4: Set the monitoring plan and any specific conditions
Turn the rating into a written plan. The regulation lists training and technical assistance, site visits and agreed-upon procedures engagements as tools to use depending on risk (2 CFR 200.332(f)). An agreed-upon procedures engagement can be charged to the award only for a subrecipient exempt from Single Audit, when you arrange and pay for it and limit its scope to allowable activities, allowable costs, eligibility and reporting (2 CFR 200.425(c)).
For higher-risk subrecipients you may impose specific conditions such as reimbursement-only payment, more detailed reports or added prior approvals. You must first tell the subrecipient the condition, the reason, what will remove it, the time allowed and how to request reconsideration (2 CFR 200.208), and 200.332(d) requires you to notify the federal agency as well.
Stage 5: Monitor reports, invoices and significant developments
At a minimum you must review financial and performance reports and make sure the subrecipient corrects significant developments, which include audit findings, site visit results and written notice of problems that will affect milestones (2 CFR 200.332(e)).
Controls. Match invoices to the budget and period of performance, compare spending with progress and scale the backup you request to the rating. Eide Bailly recommends varying the share of transactions reviewed by risk level (Eide Bailly, August 12, 2020).
What goes wrong. BDO, an accounting firm, names reliance on subrecipient self-reporting and poor documentation of monitoring as common pitfalls (BDO, April 7, 2023).
Stage 6: Verify audits and pull reports from the FAC
An entity that expends $1,000,000 or more in federal awards in a fiscal year needs a Single Audit or program-specific audit (2 CFR 200.501). Its reporting package is due 30 days after it receives the auditor’s report or nine months after year end, whichever is earlier, and pass-through entities must obtain it from the FAC (2 CFR 200.512).
Log each subrecipient’s year end, due date, report date and findings tied to your Assistance Listings. For-profit subrecipients are outside Subpart F, so the subaward must state their compliance duties (2 CFR 200.501(i)). Subrecipients report your funds on their own schedule of expenditures of federal awards, so the listing numbers you give them must be right.
Stage 7: Issue management decisions and track corrective action
You must issue management decisions for audit findings that affect your subawards (2 CFR 200.521). The decision states whether each finding is sustained, the reasons and the expected action, such as repaying disallowed costs. It must cite the auditor’s finding reference numbers and is due within six months of the FAC’s acceptance of the audit report.
You are not responsible for resolving cross-cutting findings. If the subrecipient has a current Single Audit and is not suspended or debarred, you may rely on its cognizant or oversight agency for those, but you still track findings specific to your subaward (2 CFR 200.332(e)(4)).
What goes wrong. Reports are collected but no decision letter is issued.
Stage 8: Enforce, adjust records and close out
Adjust your own records when monitoring reveals disallowed costs you already claimed (2 CFR 200.332(h)). When specific conditions cannot fix noncompliance, you may withhold payments, disallow costs, suspend or terminate the subaward or recommend suspension or debarment to the federal agency (2 CFR 200.339). A subrecipient must submit final reports and liquidate obligations within 90 days after its period of performance ends, against your own 120-day deadline (2 CFR 200.344). Keep records three years from the final financial report (2 CFR 200.334).
What your auditor tests under the Compliance Supplement
The 2025 Compliance Supplement, dated November 2025, applies to audits of fiscal years beginning after June 30, 2024 (OMB, November 25, 2025). Part 3.1 covers awards under the former Uniform Guidance and Part 3.2 covers awards under the 2024 revisions, which agencies could adopt as early as June 21, 2024 and as late as October 1, 2025 (Part 1).
Under Section 3.2-M, auditors review your policies, exclusion checks, subaward documents, monitoring records, a sample of subrecipients for audit verification and a sample of audits with findings for management decisions (Part 3). As of October 6, 2026, a draft 2026 Supplement was available for planning and the final was still under review (AICPA & CIMA, October 6, 2026).
Metrics to track
- Share of subawards with an approved risk rating dated on or before signature.
- Share of agreements passing a 200.332(b) checklist at issuance.
- Share of reportable subawards reported in SAM.gov on time.
- Share of subrecipients with confirmed audit status after their nine-month due date.
- Days from FAC acceptance to management decision, against the six-month limit.
- Count and age of open corrective actions by subrecipient.
How software supports each stage
Federal systems (free). SAM.gov handles exclusion checks and FFATA reporting. The Federal Audit Clearinghouse is where you search for and review audit reports. Neither tracks your own monitoring.
Grant management platforms. Euna Solutions says Euna Grants lets agencies configure risk criteria and score subrecipients, use reporting templates with deadline reminders and keep approvals in one audit trail (Euna Solutions, May 11, 2026). Pricing is by quote (Euna Solutions, July 28, 2026). Its material does not describe Single Audit tracking or management decisions, so ask to see stages 6 and 7.
Research administration systems. Universities often hold outgoing subawards in a sponsored programs system such as the Kuali Research Subaward module (University of Maryland, Baltimore, December 18, 2024), with risk questionnaires and audit logs kept alongside it.
Fund accounting systems. Your ledger holds obligations and payments by grant; see our guide to nonprofit accounting software.
How we researched this
We read 2 CFR 200.331 to 200.333 and related sections in the eCFR as of October 6, 2026, the 2024 Federal Register preamble and Section M of the 2025 Compliance Supplement. The top-ranking pages are mostly university policies and a vendor glossary. Several cite older section numbers (200.330 and 200.331 for what is now 200.331 and 200.332), and none we reviewed covers management decision timing or the auditor’s test steps.
Related guides
- Grant Budget Template: Categories, Narrative and 2 CFR 200
- Nonprofit Audit Checklist: PBC List and Schedules
Frequently asked questions
What is the difference between a subrecipient and a contractor?
A subrecipient carries out part of the federal program and is held to its requirements. A contractor sells goods or services to you in its normal course of business. Under 2 CFR 200.331, you judge the substance of the relationship, not the agreement’s title.
Is a risk assessment required for every subrecipient?
Yes. 2 CFR 200.332(c) requires you to evaluate each subrecipient’s fraud and noncompliance risk to set its level of monitoring. Document and date it before you sign the subaward.
How long do I have to issue a management decision on a subrecipient audit finding?
Six months from the FAC’s acceptance of the audit report, under 2 CFR 200.521(d). The letter must cite the auditor’s finding reference numbers.
What if my subrecipient spends less than $1,000,000 in federal awards?
It is exempt from Single Audit that year, but its records must stay available to you. You can increase desk reviews or arrange an agreed-upon procedures engagement, chargeable to the award under 2 CFR 200.425(c).
Sources
- 2 CFR 200.331, Subrecipient and contractor determinations, eCFR, up to date as of October 6, 2026
- 2 CFR 200.332, Requirements for pass-through entities, eCFR, up to date as of October 6, 2026
- 2 CFR 200.333, Fixed amount subawards, eCFR, up to date as of October 6, 2026
- 2 CFR 200.521, Management decisions, eCFR, up to date as of October 6, 2026
- 2 CFR 200.501, Audit requirements, and 2 CFR 200.512, Report submission, eCFR, up to date as of October 6, 2026
- 2 CFR 200.208, 200.334, 200.339, 200.344 and 200.425, eCFR, up to date as of October 6, 2026
- 2 CFR Part 170, Appendix A, Reporting subawards and executive compensation, eCFR, up to date as of October 6, 2026
- OMB, Guidance for Federal Financial Assistance, 89 FR 30046, Federal Register, April 22, 2024 (effective October 1, 2024)
- OMB, 2025 Compliance Supplement, 2 CFR Part 200 Appendix XI, November 25, 2025
- 2025 Compliance Supplement, Part 1: Background, Purpose and Applicability, OMB, no date shown on file
- 2025 Compliance Supplement, Part 3: Compliance Requirements (Section 3.2-M), OMB, no date shown on file
- Draft 2026 OMB Compliance Supplement Available for Audit Planning, AICPA & CIMA, October 6, 2026
- Fixed Amount Subaward Update, LSU Health New Orleans, October 2024
- FFATA Reporting Transitions From FSRS to SAM.gov, Forvis Mazars (accounting and advisory firm), March 7, 2025
- Subrecipient Risk Assessment Resource and Tool, Colorado Office of the State Controller, no date shown
- Common Single Audit Findings and Remediation Series: Subrecipient Monitoring, Eide Bailly (CPA firm), August 12, 2020
- Best Practices in Subrecipient Risk Assessments and Monitoring for Federal Grant Recipients, BDO (accounting firm), April 7, 2023
- Euna Grants product page, Euna Solutions, last modified July 28, 2026
- 5 Best Practices for Improving Grant Subrecipient Monitoring, Euna Solutions (sells Euna Grants), May 11, 2026
- Subawards in KR, University of Maryland, Baltimore, December 18, 2024
- Federal Audit Clearinghouse, FAC.gov, no date shown
Sherman Hsieh
Independent analysis of enterprise software — ERP, CRM and more
