Prior Approval

Prior approval functions as a risk-allocation mechanism inside the Uniform Guidance: it moves the burden of judgment about a defined set of higher-risk actions from the recipient institution to the federal awarding agency, before money is spent or a decision is executed, rather than leaving the agency to evaluate the decision retroactively during monitoring or audit. This matters operationally in two directions. For a recipient, correctly identifying that an action is a 2 CFR 200.407 or 200.308(f) trigger — and routing the request through the institution’s Signing Official rather than having a PI act unilaterally — is what keeps an otherwise defensible decision from becoming an audit finding or a disallowed cost. For an agency, the enumerated, closed list is what keeps prior approval from becoming an open-ended veto over routine project management: 200.407 states plainly that the absence of prior approval does not itself make a cost unreasonable or unallocable unless prior approval is specifically required for that item.

In practice, most institutions route prior-approval requests through the same office that manages no-cost extensions and other post-award actions, since the underlying regulatory logic and the internal sign-off chain (Signing Official, not PI) are the same. Because prior approval is one of the named risk factors federal awarding agencies weigh when assessing an applicant or recipient’s overall risk profile under 2 CFR 200.206, a pattern of prior-approval requests — or of after-the-fact discoveries that a recipient acted without required approval — can itself feed into an agency’s risk indicators and thresholds assessment and lead to more intensive monitoring on future awards. Recipients should also check their award’s specific terms and conditions and their funding agency’s own policy statement (for example, the NIH Grants Policy Statement), since agencies can and do specify additional prior-approval triggers, dollar thresholds for equipment or foreign travel, and request procedures beyond the Uniform Guidance floor.

When this last changed, and how you find out next time

The framework described above is current as of 1 October 2024. It is not static: OMB revised 2 CFR 200 on 22 April 2024, published in the Federal Register at 89 FR 30046, and 200.407’s enumerated prior-approval categories and 200.308’s budget-and-program-plan-revision triggers were carried through that revision.

OMB publishes every change to the Uniform Guidance in the Federal Register, and the Federal Register is one of the sources Regulatory Radar checks every day — so 2 CFR 200 is one of the few subjects where CASRAI reads the primary publication venue itself rather than waiting for somebody’s summary. It does not watch the NIH Guide, and it does not watch private accreditors.

Ask CASRAI whether a specific budget or project change is a 2 CFR 200.407/200.308 prior-approval trigger — it answers from an indexed corpus it re-checks daily and cites the passage it used, so you can open the source and check it. Two questions a day are free while you are signed out, no account and no card. Regulatory Radar is $29 a month for 150 a day, a subscriber dashboard, API keys and MCP access. Everything CASRAI publishes, including this page, stays free to read.

Frequently asked questions

If our institution has a genuine, good-faith pattern of prior-approval requests — not violations, just frequent legitimate use — does that still count against us under 2 CFR 200.206’s risk-indicator framework the way an after-the-fact violation would?

2 CFR 200.206 does not itself draw this distinction in its text — it names prior-approval activity as one of several risk indicators an agency may weigh, without separately scoring “legitimate frequent requests” against “after-the-fact violations discovered without approval.” In practice, a consistent record of proactively identifying triggers and requesting approval in advance is generally read as evidence of a functioning internal-control system — the opposite signal from an agency discovering unapproved action after the fact — but nothing in the regulation guarantees that reading, and how heavily it counts is decided inside each agency’s own risk-assessment procedure, not by a fixed Uniform-Guidance rule.

Can our funding agency require prior approval for something 2 CFR 200.407 doesn’t list?

Yes. The 200.407 categories and the 200.308 revision-of-budget-and-program-plans triggers are the Uniform Guidance floor, not a ceiling — a specific award’s terms and conditions, or an agency’s own policy statement (the NIH Grants Policy Statement is the most commonly cited example), can add prior-approval triggers and dollar thresholds beyond what the regulation itself requires, including agency-specific thresholds for equipment purchases or foreign travel. Checking only the Uniform Guidance list and skipping the award’s own terms is a common way an institution misses a real prior-approval obligation.

Who is actually supposed to submit a prior-approval request — can the PI send it directly to the sponsor?

The request is supposed to go through the institution’s Signing Official, not the PI acting unilaterally, because the Signing Official is the person with authority to legally bind the institution to what the agency approves. A PI who emails a program officer directly to describe a planned change, even if the program officer responds favorably, has not necessarily satisfied the formal prior-approval requirement the way a Signing-Official-routed request does — the informal exchange can leave the institution without a defensible record that prior approval was actually obtained through the correct channel.

Does taking a no-cost extension always require prior approval?

Not the first one. Most awarding agencies grant expanded authority for one no-cost extension of up to twelve months, exercised through the agency’s own system before the project end date, with only notification rather than a justified request. A second no-cost extension is not covered by that expanded authority — it is a 2 CFR 200.308(f) prior-approval event requiring a formal, justified request to the awarding agency before the original end date passes. See no-cost extension for the full request lifecycle.

Which prior-approval triggers actually come up most often in ordinary grant administration?

Most day-to-day prior-approval questions concentrate inside 2 CFR 200.308’s revision-of-budget-and-program-plans list rather than the rarer categories elsewhere in 200.407: changing the scope or objective of the project, changing key personnel identified by name or position, a PD/PI disengaging from the project for more than three months or reducing time and effort on it by 25 percent or more, adding a subaward not proposed in the original application, changing the total approved cost-sharing amount, needing additional federal funds to complete the project, and extending the project period beyond what the institution’s own expanded authority already covers. Categories like organization costs, exchange-rate losses, or insurance and indemnification exist in 200.407 but come up far less frequently for most research institutions.