Subrecipient Risk Review: A Practical Workflow

A subrecipient risk review should produce a monitoring plan, not simply a score filed beside a signed agreement. Under the revised Uniform Guidance, a pass-through entity must evaluate each subrecipient’s fraud risk and risk of noncompliance, monitor performance and compliance, and verify required audits. The practical question is what evidence to request, who reviews it, and what happens when the evidence shows a problem. 2 CFR 200.332

This guide translates those responsibilities into a manageable workflow for a nonprofit passing federal funds to partner organizations. It uses authoritative sources retrieved on October 26, 2026. Funding uncertainty appears below as an illustrative planning scenario, not as a claim about a particular shutdown, cancelled award, or new government action.

Establish which relationship you are monitoring

Before designing the review, determine whether the partner is a subrecipient or contractor. The pass-through entity makes that determination case by case. Relevant characteristics include whether the partner carries out part of the federal program, makes programmatic decisions, and is measured against program objectives, or instead provides goods or services for the purchaser’s use. The substance of the relationship matters more than the agreement’s label. OMB final guidance, 2 CFR 200.331

A nonprofit can have both kinds of relationships, including with the same organization on different activities. Avoid sending every vendor the subrecipient questionnaire automatically. Conversely, calling a partner’s agreement a “consulting contract” does not resolve its status if the partner is actually implementing the federal program.

Write a short determination explaining the work, responsibilities, and relevant characteristics. Keep it with the agreement and revisit it if the scope changes. This memo is a recommended documentation practice, not a substitute for additional agency guidance.

Confirm the applicable rules before using a template

OMB’s 2024 revisions became effective October 1, 2024; agencies could elect to apply the revisions to earlier awards but were not required to do so. Check the federal award, incorporated terms, and amendments before assuming an older subaward follows every revised provision. OMB effective-date statement

Agency requirements can add detail. EPA’s Subaward Policy describes requirements and procedures for subrecipient eligibility, oversight, and pass-through monitoring, and its public policy page identifies later revisions. Read the applicable version and current award terms together rather than relying on an old downloaded attachment alone. EPA-specific requirements should not be represented as universal requirements for every federal program. EPA Subaward Policy resource page

A template is helpful only when its owner knows which award it supports. Put the governing award identifier, guidance version, and agency-specific requirements at the top of the monitoring file.

Build a defensible subrecipient risk review

The revised rule expressly identifies fraud risk as well as noncompliance risk. It says risk evaluation should consider prior experience with similar subawards, previous audit results, new personnel or substantially changed systems, and the extent and results of federal agency monitoring. These factors are starting points for judgment, not a federally prescribed numerical scoring formula. 2 CFR 200.332(c)

A useful review records the evidence, what it means for this particular subaward, and the resulting control. For example, a finance-system replacement may increase reporting risk even at an experienced partner. A clean audit covering unrelated programs may provide less assurance about the funded activity than staff initially assume.

Risk factor	Evidence to examine	Possible monitoring response
Similar program experience	Prior delivery history and reporting examples	Orient new partners to program requirements.
Audit history	Relevant findings and corrective action status	Track unresolved findings affecting this subaward.
Staffing or system changes	Finance responsibility map and transition controls	Review initial reports and reconciliations more closely.
Fraud exposure	Approval controls, bank-change procedures, and conflicting duties	Test selected high-risk transactions and changes.
Existing federal monitoring	Reports, correspondence, and unresolved issues	Coordinate questions without assuming another review replaces yours.

The responses in this table are recommended options, not automatic federal mandates. Select measures proportionate to the actual risk and explain the reason. “Medium risk” without an explanation tells a successor almost nothing.

Ask only for information needed to assess and manage the subaward. Use secure channels for sensitive records and avoid collecting unnecessary personal identifiers. A monitoring process should not create a second, poorly controlled archive of payroll or client information.

Complete the agreement and eligibility checks

The revised pass-through requirements include verifying that the subrecipient is not excluded or disqualified. They also require clearly identifying the agreement as a subaward and including specified federal award information, applicable requirements, reporting obligations, record-access provisions, and appropriate closeout terms. 2 CFR 200.332(a)–(b)

Your setup checklist should cover:

• Subrecipient identity and unique entity identifier.
• Federal Award Identification Number and Assistance Listing information.
• Performance and budget period start and end dates.
• Federal funds obligated and the award’s project description.
• Relevant federal and agency requirements, reporting expectations, and contacts.
• Applicable indirect cost treatment.
• Access to records and financial statements for monitoring and audit.
• Closeout responsibilities and deliverables.

The indirect rate is not merely a negotiable preference in the pass-through entity’s template. The rule addresses acceptance of an approved federally negotiated rate and how to determine an appropriate rate when none exists. Resolve that question during setup rather than cutting overhead from a partner’s first invoice without examining its entitlement. 2 CFR 200.332(b)(4)

Document eligibility verification and agreement review. If information is initially unavailable, track the missing item and follow up; the regulation describes providing the best available information and supplying unavailable information when obtained.

Turn the assessment into assigned work

For every significant risk, specify a monitoring action, an owner, a timing expectation, and the evidence retained. The rule requires review of financial and performance reports and monitoring of the subrecipient’s overall performance against the subaward’s goals and objectives. It does not prescribe one universal monthly reporting frequency for all subawards. 2 CFR 200.332(e)

As an illustrative internal policy, a lower-risk partner might receive periodic financial and performance review with targeted follow-up. A partner with unresolved findings or a new accounting system might receive more frequent reporting review, technical assistance, and a targeted site visit. The selected cadence must also satisfy the actual award and subaward terms.

Finance staff should compare reported costs with the agreement, budget, and supporting records where needed. Program staff should assess whether outputs and milestones are credible and on schedule. Share conclusions: a financially tidy report does not prove the program delivered, and strong program delivery does not establish every charge was allowable.

The regulation identifies training, technical assistance, site visits, and agreed-upon-procedures engagements as potentially useful tools depending on assessed risk. Choose the tool that answers the question; do not default to a costly engagement when a focused report review could resolve it. 2 CFR 200.332(f)

Hypothetical example: a reimbursement delay

Suppose a community-services nonprofit passes federal funding to a partner that relies on reimbursement. The partner reports that an anticipated payment is delayed, its finance manager has left, and payroll coverage is becoming difficult. These are hypothetical facts, not a report of an actual federal funding disruption.

The monitoring lead first confirms what the partner has communicated, which milestones may be affected, and what the signed agreement allows. The finance lead requests a concise cash forecast and a reconciliation of reported costs to supporting records. The program lead asks which service commitments can still be met. Together they update the risk assessment and document a response.

A cash problem does not itself prove fraud or justify declaring all costs unallowable. It may, however, expose weak approvals, late reporting, or pressure to move costs between grants. Ask targeted questions instead of making unsupported accusations.

Do not advise the partner to use another restricted award as a temporary bridge without examining its restrictions and legal authority. Do not promise that a pass-through entity can change federal payment terms or increase funding unilaterally. Seek written direction from the responsible award official where an amendment, payment change, or other authorization is needed.

The rule requires corrective action on significant developments that negatively affect the subaward, including adverse conditions affecting milestones or objectives. A partner’s written notification should describe its corrective plan and assistance needed. That obligation is more useful than letting an unresolved issue sit in an email inbox. 2 CFR 200.332(e)(2)

Use audits as evidence, not a substitute for monitoring

Pass-through entities must verify that subrecipients obtain audits when required under Subpart F. The FAC states that the threshold is $1,000,000 of federal awards expended for fiscal years starting on or after October 1, 2024, and $750,000 for fiscal years starting earlier. Determine the partner’s relevant fiscal year and federal expenditure total; the size of your own subaward alone does not settle the question. 2 CFR 200.332(g); FAC threshold guidance

A partner below the threshold still needs risk-based monitoring. A partner above it still needs monitoring between audits. Record what a report actually covers, which findings relate to your subaward, and whether corrective action has been completed.

The rule distinguishes responsibility for findings specifically related to the subaward from cross-cutting findings involving other awards. In specified circumstances, the pass-through entity may rely on the cognizant or oversight agency for cross-cutting audit follow-up, but that reliance does not remove ongoing subaward risk-management responsibilities. 2 CFR 200.332(e)(3)–(4)

Close the loop with a corrective-action log

Maintain a log identifying the issue, supporting evidence, responsible person, agreed response, target date, and closure evidence. Distinguish a routine clarification from a significant adverse development or an audit finding requiring a formal management decision.

Escalate missed corrective steps using the agreement and applicable regulations. Where appropriate, the revised rule addresses specific subaward conditions, notification to the federal agency, and consideration of enforcement action. Do not describe every corrective conversation as a suspension or invent remedies outside the pass-through entity’s authority. 2 CFR 200.332(d), (i)

For background on identifying and separating funding sources, read our fund accounting overview. For organizing budgets, reporting periods, and supporting records across awards, see our guide to tracking multiple grants. Effective monitoring depends on connecting those records with actual program performance, not on a particular software purchase.

Educational disclaimer: This article provides general educational information, not legal advice or a determination of subrecipient status, audit applicability, or enforcement authority. Confirm the governing award terms, agency requirements, and proposed response with qualified advisers and the responsible grant official.

Sources

All sources accessed October 26, 2026. The eCFR section is the October 1, 2024 revision; the live Part 200 version history identified that as the latest revision date when checked.

• eCFR, 2 CFR 200.332, official section text: eligibility, subaward terms, risk evaluation, monitoring, audits, and corrective action.
• OMB, Guidance for Federal Financial Assistance, April 22, 2024 final guidance: effective date and the text of 2 CFR 200.331 and 200.332.
• EPA, Subaward Policy resource page: agency-specific oversight framework and revision notices.
• Federal Audit Clearinghouse, Is my organization required to conduct a Single Audit?: fiscal-year audit threshold transition.
• eCFR, live Part 200 version history: revision-date verification.