Subrecipient monitoring

Required by 2 CFR 200.332, subrecipient monitoring includes initial risk assessment at award time, financial monitoring (invoice review, expenditure documentation), programmatic monitoring (progress reports, deliverables), and audit follow-up (review of subrecipient’s Single Audit findings, if applicable). The prime is ultimately responsible to the sponsor for subrecipient performance. Risk-based monitoring approaches concentrate oversight effort on higher-risk subrecipients. See the Subrecipient Monitoring Checklist for how these four components translate into a practical, step-by-step review.

Vantage point: the oversight activity, not the relationship itself

Subrecipient monitoring is the activity a prime award holder performs downward once a subaward exists — distinct from “prime award,” which names the funder-facing relationship, and distinct from Horizon Europe’s coordinator/partner roles, which describe co-equal beneficiaries jointly party to a single EU Grant Agreement rather than a prime/subrecipient hierarchy (Horizon Europe consortia can still involve subcontractors or third parties that functionally resemble subrecipients, but the terminology and flow-down mechanics differ).

The MTDC subaward threshold: general rule and NIH exception

Under 2 CFR 200.1’s definition of Modified Total Direct Cost, indirect costs apply only to the first $50,000 of each subaward — raised from $25,000 in OMB’s April 2024 Uniform Guidance revision, for awards issued on or after 1 October 2024; costs beyond that are excluded from the base entirely. See MTDC for the full definition. This figure is quoted from a WebSearch snippet of the current eCFR text rather than an independently re-fetched primary page (a direct ecfr.gov fetch redirected to an access-gate this session); treat as REPORTED/eCFR-adjacent tier. NIH is a documented exception: Notice NOT-OD-26-072 (20 April 2026) reverted NIH awards specifically back to the $25,000 subaward threshold, alongside the parallel 10 percent de minimis reversion described on cost reimbursement, citing the same FY2026 appropriations-rider rationale (45 CFR Part 75 parity). Both the general and NIH-specific figures are secondary-sourced — attributed to COGR, Harvard OSP, and Princeton ORPA summaries rather than a direct grants.nih.gov fetch, which 403s to automated requests.

Separately, a prime may issue a subaward on a fixed-amount rather than cost-reimbursement basis, with prior federal-agency approval, up to $500,000 (2 CFR 200.333, raised from $250,000 in the same April 2024 revision) — see fixed-price grant.

The four components, and what each one actually requires

The single sentence that opens this entry — initial risk assessment, financial monitoring, programmatic monitoring, and audit follow-up — compresses four separate regulatory obligations that are easy to treat as one generic “monitoring” duty. They are not equivalent, and an auditor tests each one separately.

• Risk assessment (2 CFR 200.332(c)) happens before the subaward is issued, not during it, and drives everything that follows: the four named factors are the subrecipient’s prior experience with similar subawards, the results of previous audits, whether the subrecipient has new or substantially changed personnel or systems, and the extent and results of any federal agency monitoring. See subrecipient risk assessment for the full mechanics.
• Financial monitoring is invoice-level: matching each subrecipient invoice to its approved budget, confirming costs are allowable under the subaward’s own cost principles, and tracking cumulative drawdown against the amount obligated.
• Programmatic monitoring tests deliverables and progress reports against the subaward’s approved scope of work — the project description that is itself one of the fourteen data elements 2 CFR 200.332(a) requires the pass-through entity to put in the subaward at issuance, alongside the subrecipient’s unique entity identifier, the Federal Award Identification Number, the period of performance, the amount obligated, and the applicable indirect cost rate.
• Audit follow-up is the step reviewers most often miss: if a subrecipient’s Single Audit reports a finding that touches the pass-through entity’s award, 2 CFR 200.521 requires the pass-through entity — not only the federal awarding agency — to issue its own management decision on that finding within six months of the Federal Audit Clearinghouse accepting the audit report, stating whether the finding is sustained and what corrective action the subrecipient must take.

Which of the four gets emphasized, and how often, is not left to the pass-through entity’s discretion in the abstract: 2 CFR 200.332(f) names training and technical assistance, an on-site or virtual programmatic review, and an agreed-upon-procedures engagement under 2 CFR 200.425 as the tools available once the pre-award risk assessment has set the intensity a given subrecipient warrants.

When this last changed, and how you find out next time

The subaward figures cited above are current as of 1 October 2024. They are not permanent: OMB revised 2 CFR 200 on 22 April 2024, published in the Federal Register at 89 FR 30046, and the $50,000 MTDC threshold and $500,000 fixed-amount subaward ceiling above are the post-revision figures.

OMB publishes every change to the Uniform Guidance in the Federal Register, and the Federal Register is one of the sources Regulatory Radar checks every day — so 2 CFR 200 is one of the few subjects where CASRAI reads the primary publication venue itself rather than waiting for somebody’s summary. It does not watch the NIH Guide, and it does not watch private accreditors.

Ask CASRAI what 2 CFR 200.332 currently requires for subrecipient monitoring at your risk tier — it answers from an indexed corpus it re-checks daily and cites the passage it used, so you can open the source and check it. Two questions a day are free while you are signed out, no account and no card. Regulatory Radar is $29 a month for 150 a day, a subscriber dashboard, API keys and MCP access. Everything CASRAI publishes, including this page, stays free to read.

Frequently asked questions

What does 2 CFR 200.332 actually require us to do differently for a high-risk subrecipient, and how much monitoring is enough to survive a Single Audit finding?

The regulation does not set a numeric floor — it names three monitoring tools a pass-through entity may add once its 2 CFR 200.332(c) risk assessment flags a subrecipient as higher risk: additional training and technical assistance, an on-site or virtual programmatic review, and an agreed-upon-procedures engagement under 2 CFR 200.425. What counts as “enough” is a documentation question as much as an intensity question — an auditor testing this area checks whether the monitoring actually applied matches the risk level the pass-through entity itself assigned, not whether it clears some fixed industry benchmark. A subrecipient assessed as high-risk and then given the same light-touch quarterly report review as a low-risk one is the pattern that produces a finding, regardless of how much monitoring activity happened in absolute terms.

What has to be in the subaward itself, before any monitoring activity starts?

2 CFR 200.332(a) requires the pass-through entity to include fourteen specific data elements in every subaward at issuance — among them the subrecipient’s name and unique entity identifier, the Federal Award Identification Number, the federal award date, the subaward period of performance and budget period, the amount of federal funds obligated, the federal award project description, and the applicable indirect cost rate. Programmatic monitoring later in the award period tests deliverables against the project description recorded here, so an incomplete subaward document is a monitoring problem before it is anything else.

How is this different from a subrecipient risk assessment?

Subrecipient risk assessment is the pre-award step, performed under 2 CFR 200.332(c) before a subaward is issued, that decides how much of the four monitoring components apply to a given subrecipient. Subrecipient monitoring is the resulting ongoing activity — financial, programmatic, and audit-follow-up oversight performed once the subaward exists. An institution that skips the risk assessment and applies identical monitoring to every subrecipient has not satisfied 200.332(c), even if the monitoring it does perform is otherwise diligent.

What happens if a subrecipient’s Single Audit reports a finding tied to our subaward?

2 CFR 200.521 puts the responsibility on the pass-through entity, not only the federal awarding agency, to issue a management decision on any finding in a subrecipient’s Single Audit report that pertains to the pass-through entity’s own federal award. That management decision — stating whether the finding is sustained and what corrective action the subrecipient must take — is due within six months of the Federal Audit Clearinghouse accepting the subrecipient’s audit report. Missing that deadline is itself a monitoring failure independent of the underlying finding.

Does the $50,000 MTDC indirect-cost threshold change how much we have to monitor a subrecipient?

No — the two are separate questions raised by the same 2024 Uniform Guidance revision. The $50,000 Modified Total Direct Cost threshold (raised from $25,000; see MTDC) governs how much of a subaward’s cost base carries indirect costs; it has nothing to do with the monitoring intensity 2 CFR 200.332(c)’s risk factors assign. A subrecipient can sit well under the MTDC threshold and still be assessed as high risk, and one issued a large fixed-amount subaward under the $500,000 ceiling can still be low risk if its audit and personnel history support it.

References

• US Office of Management and Budget Uniform Guidance 2 CFR 200.332; NCURA subrecipient monitoring guidance.