Audit Corrective Action Plan (Grants)

An audit corrective action plan is the document a grantee institution submits in response to findings in its US federal Single Audit, prepared under 2 CFR 200.511(c) of the Uniform Guidance. It is one of the required components of the Single Audit reporting package submitted to the Federal Audit Clearinghouse (FAC), sitting alongside the auditor’s opinions, the Schedule of Expenditures of Federal Awards, and the Schedule of Findings and Questioned Costs — but unlike those, it is written entirely by the auditee, not the auditor.

This is a distinct document from a clinical-research quality-system CAPA (Corrective and Preventive Action). Both share the same underlying logic — identify a problem, fix it, prevent recurrence — but the audit corrective action plan responds specifically to a federal grants-compliance finding under the Uniform Guidance, follows a fixed regulatory format, and becomes part of a public federal filing rather than an internal quality record.

What the plan must contain

2 CFR 200.511(c) requires the corrective action plan to be a document separate from the auditor’s own findings, and to address each current-year finding in the Schedule of Findings and Questioned Costs individually. For every finding, it must include:

• The name(s) of the contact person(s) responsible for the corrective action
• A description of the corrective action to be taken
• The anticipated completion date

If the auditee does not agree with a finding, or believes corrective action isn’t warranted, the plan must instead include a detailed explanation of the reasons for the disagreement, in place of a planned corrective action. Silence, a vague acknowledgment, or a single sentence promising to “address” a finding without naming a responsible person and a completion date does not meet the regulation’s requirements.

Template structure

There is no single federally-mandated form for the corrective action plan (it is not a numbered SF form the way the SF-425 or the SF-SAC data collection form are), but because 200.511(c) specifies exactly what each entry must contain, a usable template repeats a consistent block per finding:

• Finding reference number (matching the number assigned in the Schedule of Findings and Questioned Costs, e.g. “Finding 2025-001”)
• Brief restatement of the finding and the federal program it relates to
• Name and title of the responsible contact person
• Description of the planned corrective action (or a detailed explanation of disagreement, if applicable)
• Anticipated completion date

Institutions that carry a finding forward from a prior year should also reconcile the current plan against the summary schedule of prior audit findings required under 200.511(b), which separately tracks whether each older finding was resolved, is still in progress, or is no longer valid — a corrective action plan that doesn’t line up with what the prior-year schedule reports is itself a common point of scrutiny.

Submission timing and what happens next

The corrective action plan is submitted together with the rest of the reporting package to the Federal Audit Clearinghouse within 30 calendar days of the auditee receiving the auditor’s report(s), or nine months after the end of the audit period, whichever is earlier (2 CFR 200.512). It doesn’t stand alone as a compliance step — the federal awarding agency or pass-through entity reviews the finding together with the auditee’s corrective action plan and issues a management decision on the finding, required within six months of the FAC accepting the audit report under 2 CFR 200.521. That management decision determines whether a questioned cost is allowed, disallowed, or needs further documentation, and whether the agency considers the finding closed.

A corrective action plan that repeatedly promises the same fix without follow-through is itself a risk signal: unresolved repeat findings feed directly into whether a federal awarding agency treats an auditee as high-risk for future awards, and oversight bodies such as agency Offices of Inspector General may review an entity’s audit and corrective-action history when planning further review or audit activity.

Who prepares it

The auditee — typically the institution’s grants/sponsored-programs office working with the finance office and whichever department or unit the finding concerns — prepares the corrective action plan. The independent auditor does not draft it, though the auditor’s Schedule of Findings and Questioned Costs is what the plan responds to, finding by finding.

Related CASRAI Dictionary terms and guides

Single Audit (US) · Single Audit Report Example: Inside a Reporting Package’s Structure · Grant audit · CAPA (Corrective and Preventive Action) · Subrecipient monitoring · Closeout phase · OIG Reports

Worked example: from finding to closed corrective action plan

A Single Audit tests 15 of a university’s subawards and finds that 3 lacked a documented pre-award risk assessment — a significant deficiency in subrecipient monitoring under 2 CFR 200.332. The finding is written up as Finding 2025-001 in the Schedule of Findings and Questioned Costs.

The university’s Office of Sponsored Programs, as the named responsible party, prepares the corrective action plan for the reporting package: it names the OSP director as the contact, describes the corrective action as adding a mandatory documented risk-assessment step to the subaward issuance checklist before any subaward can be executed, and sets a completion date six months out, timed to the start of the next fiscal year’s subaward cycle. Because the university agrees with the finding, no disagreement explanation is needed.

The plan is submitted with the rest of the reporting package to the Federal Audit Clearinghouse within 30 calendar days of receiving the auditor’s report. The cognizant federal agency reviews the finding together with the plan and, within six months of FAC acceptance, issues a management decision under 2 CFR 200.521: it accepts the plan, and no cost is questioned or disallowed, because the finding was a documented-process gap rather than a specific misspent dollar. The following year’s Single Audit tests the revised checklist, finds the risk assessment now consistently completed and documented across the sample tested, and the summary schedule of prior audit findings under 200.511(b) lists Finding 2025-001 and states that corrective action was taken — closing the loop the original plan opened.

When this last changed, and how you find out next time

The corrective-action-plan requirement described above is current as of 1 October 2024. It is not static: OMB revised 2 CFR 200 on 22 April 2024, published in the Federal Register at 89 FR 30046, and 200.511(c)’s corrective-action-plan elements and 200.512’s reporting-package deadline were carried through that revision.

OMB publishes every change to the Uniform Guidance in the Federal Register, and the Federal Register is one of the sources Regulatory Radar checks every day — so 2 CFR 200 is one of the few subjects where CASRAI reads the primary publication venue itself rather than waiting for somebody’s summary. It does not watch the NIH Guide, and it does not watch private accreditors.

Ask CASRAI whether disagreeing with a Single Audit finding actually closes it — it answers from an indexed corpus it re-checks daily and cites the passage it used, so you can open the source and check it. Two questions a day are free while you are signed out, no account and no card. Regulatory Radar is $29 a month for 150 a day, a subscriber dashboard, API keys and MCP access. Everything CASRAI publishes, including this page, stays free to read.

Frequently asked questions

If we disagree with a finding and explain why in our corrective action plan, does that disagreement end the matter, or can the federal agency’s management decision under 2 CFR 200.521 override it and still require corrective action anyway?

No — disagreement does not close the finding on its own. Filing a “detailed explanation” under 200.511(c) is the required alternative to a planned corrective action, but the pass-through entity or federal awarding agency still evaluates the finding and issues a management decision under 2 CFR 200.521 stating whether it accepts the explanation. That management decision, not the auditee’s own disagreement, is what actually determines whether a questioned cost is allowed, disallowed, or needs more support — an explanation the agency does not accept typically converts into a required corrective action the following cycle.

What happens if the anticipated completion date in our corrective action plan passes and the fix still isn’t done?

The finding carries into the next year’s Single Audit as a repeat finding, and 200.511(b)’s summary schedule of prior audit findings then requires the auditee to describe the reasons for the recurrence, the corrective action now planned, and any partial correction already taken — simply restating the same completion date without an update is a common way this section draws scrutiny. Nothing in 2 CFR 200 attaches an automatic penalty to a missed completion date by itself, but a pattern of missed or repeated corrective-action deadlines is exactly the kind of history a federal agency weighs when assessing an institution’s risk for future awards.

Does filing a corrective action plan resolve a questioned cost, or is that decided separately?

Separate. The corrective action plan addresses the underlying control or compliance gap the finding identified, going forward; whether a specific questioned-cost dollar amount is allowed, disallowed, or needs further documentation is decided by the management decision under 2 CFR 200.521, not by the corrective action plan itself. An institution can have a complete, accepted corrective action plan on file and still owe a disallowed cost arising from the same finding.

Who actually receives the corrective action plan besides the Federal Audit Clearinghouse?

It becomes part of the public Single Audit record once accepted by the FAC, so a pass-through entity that wants to see a subrecipient’s corrective action plan as part of its own subrecipient monitoring can pull it directly from the FAC’s public search rather than requesting a separate copy from the subrecipient — one of the few places in federal grants compliance where a counterparty’s own corrective action history is a matter of public record.