Subrecipient Monitoring Checklist: A Pass-Through Entity’s Obligations Under 2 CFR 200.332

Under 2 CFR §200.332, an organization that passes federal grant funds through to a subrecipient (a “pass-through entity,” or PTE) does not get to walk away once the subaward agreement is signed. The PTE remains accountable to the federal awarding agency for how those funds are used, which means it must evaluate a subrecipient’s risk before making the subaward, monitor the subrecipient’s performance and spending throughout the period of performance, and follow up on any audit findings that turn up along the way. This guide walks through each obligation in order and ends with a practical checklist a research administration or sponsored-programs office can use directly.

Who this applies to

The obligations below apply to any non-federal entity that makes a subaward of federal funds it received under a federal grant or cooperative agreement — most commonly a university, hospital, or research institute passing funds to a collaborating institution named in the proposal. They apply regardless of the subaward’s payment structure (cost-reimbursement or fixed-amount) and regardless of dollar size, though the intensity of monitoring is explicitly meant to scale with risk, not applied uniformly. See the CASRAI Subaward term for the underlying definition, and Subrecipient vs. Contractor vs. Vendor for the threshold question of whether 2 CFR 200.332 even applies to a given relationship — contractors and vendors are procurement relationships governed by different Uniform Guidance sections (200.317-200.327), not subrecipient monitoring.

What changed in the October 2024 revision

OMB last revised the Uniform Guidance in “Guidance for Federal Financial
Assistance,” 89 FR 30046 (April 22, 2024), effective for
federal awards issued on or after October 1, 2024. Three changes in that
revision affect subrecipient monitoring directly:

Effective	What changed	Published in
1 October 2024	New duty at 2 CFR 200.332(a): the pass-through entity must verify a subrecipient is not suspended, debarred, or otherwise excluded from receiving federal funds (most practically, a SAM.gov check per 2 CFR 180.300) before making the subaward.	89 FR 30046
1 October 2024	2 CFR 200.332(c) now names fraud risk separately from noncompliance risk — the pre-2024 text asked pass-through entities to evaluate noncompliance risk only.	89 FR 30046
1 October 2024	The de minimis indirect cost rate rose from 10% to 15% (2 CFR 200.414(f)), and the Single Audit threshold rose from $750,000 to $1,000,000 (2 CFR 200.501(a)).	89 FR 30046

Every row above is an OMB document published in the Federal Register. That is the
publication Regulatory Radar checks daily, which is why a table like this one can be kept
current — the next Uniform Guidance revision would surface there too.

Before the subaward: risk assessment (2 CFR 200.332(c))

Before it makes a subaward, a pass-through entity must evaluate each proposed subrecipient’s risk of fraud and noncompliance for purposes of determining the appropriate level of subsequent monitoring. 2 CFR 200.332(c) names four factors the PTE must consider:

• Prior experience with the same or similar subawards. Has this subrecipient successfully administered comparable federal subawards before, from this PTE or elsewhere?
• Results of previous audits. This includes whether the subrecipient has been subject to a Single Audit, and whether awards similar to the one being made were reviewed as part of that audit’s major-program testing.
• Whether the subrecipient has new personnel or new or substantially changed systems. A subrecipient with a recent change in its financial-management system or key administrative staff carries more risk than one with stable, proven systems.
• The extent and results of any federal agency monitoring. If the subrecipient also receives funding directly from a federal agency, that agency’s own oversight history is relevant evidence of the subrecipient’s compliance posture.

This assessment doesn’t have to be elaborate, but it does have to be documented — the risk determination is what justifies the monitoring plan the PTE puts in place for that specific subrecipient. A first-time subrecipient with no Single Audit history, or one flagged by a prior finding, should reasonably trigger a higher level of monitoring than an established collaborator with a clean audit record.

Separately, at the time it makes the subaward, the PTE must also flow down all applicable federal award requirements to the subrecipient and communicate specific subaward information (Federal award identification, applicable indirect cost rate treatment, and other terms). On indirect costs specifically: a pass-through entity must accept a subrecipient’s existing federally negotiated indirect cost rate and cannot compel the subrecipient to use the de minimis rate instead; a subrecipient with no current negotiated rate may elect the de minimis rate or negotiate one with the PTE.

2 CFR 200.332(a) adds a threshold step ahead of all of this: before making the subaward,
the pass-through entity must verify the subrecipient is not suspended, debarred, or otherwise
excluded from receiving federal funds, typically by checking SAM.gov
per 2 CFR 180.300. This is a pass/fail check, not a risk factor to weigh — it has to happen
regardless of how the four-factor risk assessment above comes out.

Where the risk assessment warrants it, 2 CFR 200.332(d) also lets the pass-through entity
impose specific conditions on the subaward — more frequent reporting, additional
prior-approval requirements, or similar — and requires the PTE to notify the federal
awarding agency when it does. A documented risk assessment that never results in a specific
condition for any subrecipient, regardless of risk level, is itself a sign the assessment isn’t
actually driving the monitoring plan.

Setting monitoring intensity to match risk

2 CFR 200.332 does not prescribe a single fixed monitoring procedure for every subaward — it requires the PTE to monitor “as necessary” based on the risk evaluation above. In practice, that means a low-risk, experienced subrecipient with a strong audit history might receive standard periodic report review, while a higher-risk subrecipient (new to federal funding, recent findings, changed systems, or simply a large dollar award) warrants more frequent report review, targeted follow-up questions, and an on-site or virtual site visit during the period of performance rather than only at closeout.

Ongoing monitoring during the period of performance (2 CFR 200.332(e)-(f))

Once the subaward is active, 2 CFR 200.332(e) requires the pass-through entity to:

• Review financial and performance reports the subrecipient submits, checking them against the approved budget, scope of work, and reporting schedule — not simply filing them.
• Follow up on significant developments, including ensuring the subrecipient takes timely and appropriate corrective action on deficiencies identified through audits, on-site reviews, or other monitoring.
• Issue a management decision for audit findings pertaining to the federal award that flows through the subaward, and resolve audit findings specifically related to the subaward itself (a PTE may rely on a cognizant or oversight agency for cross-cutting findings that reach beyond a single award).

2 CFR 200.332(f) lists additional monitoring tools a PTE may use depending on the risk level, including:

• Providing subrecipients with training and technical assistance on program-specific and administrative/financial requirements;
• Performing on-site reviews of the subrecipient’s program operations;
• Arranging for agreed-upon-procedures engagements as described in 2 CFR 200.425.

None of these tools is mandatory for every subaward — they’re the toolkit a PTE draws from in proportion to the risk level it documented before making the award. A higher-risk subrecipient is where a PTE should actually schedule a site visit or require more frequent interim reporting; applying the same light-touch monitoring to every subrecipient regardless of risk is itself a compliance gap an auditor or federal awarding agency can flag.

Following up on audit findings

Subrecipient monitoring doesn’t end when a report is filed or a site visit is completed — it includes closing the loop on anything that monitoring turns up. Where a subrecipient’s own Single Audit (required once it expends $1,000,000 or more in federal awards in a fiscal year, per 2 CFR 200.501(a)) produces a finding related to the PTE’s subaward, the PTE is responsible for issuing a management decision and confirming the subrecipient has taken corrective action, not merely noting the finding exists. Rounding out this stage, 2 CFR 200.332(g)–(i) also
require the PTE to verify the subrecipient’s own Single Audit compliance under Subpart F
where applicable, adjust the PTE’s own records and financial statements to reflect audit or
monitoring results, and consider enforcement action against the subrecipient under
2 CFR 200.339 where noncompliance continues after corrective
action has been requested. See the CASRAI guides on the Federal Audit Clearinghouse (FAC) submission process and Single Audit reporting package structure for how those findings surface in the first place, and internal controls under 2 CFR 200.303 for the broader control environment this monitoring sits inside.

A practical subrecipient monitoring checklist

The list below sequences the obligations above into a working checklist for a sponsored-programs or research-administration office.

Before the subaward is issued:

• Confirm the relationship is genuinely a subaward, not a procurement contract — see Subrecipient vs. Contractor vs. Vendor and 2 CFR 200.331’s substance-over-form test.
• Document the risk assessment against all four 200.332(c) factors: prior subaward experience, prior audit results, personnel/systems changes, and any existing federal agency monitoring of the subrecipient.
• Confirm the subrecipient’s indirect cost rate treatment (existing negotiated rate, de minimis election, or a rate negotiated directly with the PTE) before the subaward budget is finalized.
• Set the monitoring plan — reporting frequency, whether a site visit is warranted, and who on the PTE side owns follow-up — based on the documented risk level, and record it in the subaward file.
• Flow down all applicable federal award terms and conditions into the subaward agreement itself.
• Verify the subrecipient is not suspended, debarred, or otherwise excluded from receiving
  federal funds — check SAM.gov per 2 CFR 180.300 (2 CFR
  200.332(a)).
• Where the risk level warrants it, impose specific conditions on the subaward and notify the
  federal awarding agency that you have (2 CFR 200.332(d)).

During the period of performance:

• Review each financial and performance/progress report against the approved budget and scope of work on receipt, not just before submission to the sponsor.
• Track report due dates separately from the prime award’s own reporting deadlines — subrecipient deadlines are typically set earlier to allow time for compilation into the prime’s report.
• Conduct an on-site or virtual site visit for higher-risk subrecipients, and document what was reviewed and any issues identified.
• Offer training or technical assistance where a subrecipient’s reports or a site visit reveal a gap in understanding of federal requirements, rather than only citing noncompliance after the fact.
• Log any significant development — a missed deadline, a budget variance, a personnel change, an audit finding — and track it through to resolution, not just to acknowledgment.

When an audit finding or significant issue surfaces:

• Determine whether the finding relates to the federal award generally (management decision required from the PTE) or is specific to the subaward (resolution required from the PTE directly).
• Issue a timely, written management decision describing whether the finding is sustained, what corrective action is required, and the timeline for that action.
• Confirm the subrecipient has implemented the corrective action, not just proposed it, before considering the finding closed.
• Retain the full documentation trail — risk assessment, monitoring records, correspondence,
  and finding resolution — per the institution’s record-retention schedule
  (2 CFR 200.334).
• Verify the subrecipient’s own Single Audit compliance under Subpart F as part of
  resolving the finding, where a Single Audit applies (2 CFR 200.332(g)).
• Adjust the PTE’s own records and financial statements to reflect the audit or monitoring
  result, where warranted (2 CFR 200.332(h)).
• Consider enforcement action under 2 CFR 200.339 if the
  subrecipient does not complete corrective action after being asked (2 CFR 200.332(i)).

At subaward closeout:

• Confirm all required final financial and performance reports have been received and reviewed.
• Confirm any outstanding audit findings tied to the subaward have been resolved or have a documented resolution plan.
• Complete closeout steps consistent with the PTE’s own closeout obligations under
  2 CFR 200.344.

In most institutions, the risk-assessment and monitoring-plan decisions above sit with a
sponsored-programs or research-administration office, while issuing the management decision on
an audit finding and adjusting the institution’s own financial records (2 CFR 200.332(h))
more often sits with grants and contracts accounting or the institution’s audit office —
naming that split up front avoids a finding sitting unresolved while two offices each assume the
other owns it. When a Single Audit auditor actually tests subrecipient monitoring, the document
they work from is the OMB Compliance Supplement, Part 3, Section M — worth
having on hand alongside the CFR text itself before an audit, not just referenced from memory.

Common pitfalls

• Treating the risk assessment as a one-time formality. An assessment that isn’t documented, or that doesn’t actually drive a different monitoring plan for higher-risk subrecipients, doesn’t satisfy 200.332(c) in substance even if a checkbox exists somewhere in the file.
• Filing reports without reviewing them. Receiving a financial or performance report is not the same as reviewing it against the budget and scope of work; only the latter satisfies 200.332(e)(1).
• Confusing subrecipient monitoring with procurement oversight. A vendor or contractor relationship is governed by the procurement standards (2 CFR 200.317-200.327), not 200.332 — applying subrecipient-monitoring paperwork to a contractor, or vice versa, misapplies both frameworks.
• Not closing the loop on findings. Noting an audit finding without issuing a management decision or confirming corrective action leaves the PTE’s own compliance exposure open, since the PTE (not just the subrecipient) is accountable to the federal awarding agency.

Where each of these requirements is written down

Requirement	Authority	Where to read it
Pre-subaward exclusion check	2 CFR 200.332(a)	eCFR §200.332
Risk assessment (fraud and noncompliance)	2 CFR 200.332(c)	eCFR §200.332
Specific conditions on higher-risk subawards	2 CFR 200.332(d)	eCFR §200.332
Report review and follow-up during the period of performance	2 CFR 200.332(e)–(f)	eCFR §200.332
Verifying the subrecipient’s Single Audit and resolving findings	2 CFR 200.332(g)–(h)	eCFR §200.332
Enforcement action against a noncompliant subrecipient	2 CFR 200.339	eCFR §200.339
Subrecipient vs. contractor determination	2 CFR 200.331	eCFR §200.331
Single Audit threshold ($1,000,000)	2 CFR 200.501(a)	eCFR §200.501
Record retention	2 CFR 200.334	eCFR §200.334
Closeout	2 CFR 200.344	eCFR §200.344
The October 2024 revision itself	OMB, “Guidance for Federal Financial Assistance”	89 FR 30046

What this page cannot tell you

Three things decide your actual case, and none of them are in this article, because they are
specific to your award and your institution:

• Whether your subrecipient has ever had a Single Audit — a subrecipient
  below the $1,000,000 threshold, or new to federal funding, has no Single Audit for you to rely on
  as an input, which changes what your own monitoring plan needs to cover.
• Your institution’s own process for documenting a 2 CFR 200.208 specific
  condition — who signs off on it and how it gets communicated to the subrecipient
  varies by institution.
• The terms your specific notice of award adds above the Uniform Guidance floor
  — a federal awarding agency can require monitoring beyond what 2 CFR 200.332 sets as the
  baseline.

Ask CASRAI about your own subaward

The October 2024 revision covered above (89 FR 30046) is exactly the
kind of change Regulatory Radar exists to catch: OMB publishes every Uniform Guidance revision in
the Federal Register, and the Federal Register is one of the sources Regulatory Radar checks
every day — so 2 CFR 200 is one of the few subjects where CASRAI reads the primary
publication venue itself rather than waiting for somebody’s summary. It does not watch the NIH
Guide, and it does not watch private accreditors.

Ask
CASRAI what 2 CFR 200.332 currently requires once a subrecipient crosses the single-audit
threshold — it answers from an indexed corpus it re-checks daily and cites the passage
it used, so you can open the source and check it. Two questions a day are free while you
are signed out, no account and no card. Regulatory Radar is $29 a month for 150 a day, a
subscriber dashboard, API keys and MCP access. Everything CASRAI publishes, including this page,
stays free to read. Save your second question for the part that depends on your own subrecipient
— its actual audit history, or the specific conditions your notice of award adds.

Frequently asked questions

What does 2 CFR 200.332 require me to do differently once a subrecipient crosses the $1,000,000 single-audit threshold, and what if my subrecipient has never had a Single Audit?

Once a subrecipient expends $1,000,000 or more in federal awards in its fiscal year, it is subject to a Single Audit, and that audit becomes an input into your monitoring — you should be watching for its Audit Clearinghouse submission and reviewing any findings that touch your subaward, per 2 CFR 200.332(g). Below that threshold, or for a subrecipient new to federal funding, there is no Single Audit to rely on: your own risk assessment and monitoring plan under 200.332(c)–(f) are doing the whole job, not supplementing an audit. A subrecipient that should have had a Single Audit and didn’t is itself a risk signal worth escalating, not a box you can leave unchecked.

Does a subrecipient’s own Single Audit satisfy the pass-through entity’s monitoring obligation?

No. A subrecipient’s Single Audit (where applicable, at $1,000,000+ in annual federal expenditures) is one input into the PTE’s risk assessment and a source of findings the PTE must follow up on — it does not substitute for the PTE’s own ongoing monitoring of reports, corrective actions, and (where risk warrants) site visits during the period of performance.

What’s the difference between a subrecipient and a contractor for monitoring purposes?

2 CFR 200.331 sets out a substance-over-form test: a subrecipient carries out a portion of the federal award’s programmatic effort and is measured against the award’s objectives, while a contractor provides goods or services within its normal business operations for the PTE’s own use. Only subrecipient relationships trigger 200.332 monitoring; contractor relationships are governed by the procurement standards instead. See Subrecipient vs. Contractor vs. Vendor for the full test.

Who is responsible for resolving an audit finding tied to a subaward — the subrecipient or the pass-through entity?

Both, in different roles. The subrecipient is responsible for implementing corrective action. The pass-through entity is responsible for issuing the management decision on findings related to the federal award and for resolving findings specific to the subaward — the PTE remains accountable to the federal awarding agency even though the underlying deficiency sits with the subrecipient.

For the underlying regulatory framework this checklist implements, see the CASRAI guides on subaward agreement negotiation and 2 CFR 200 procurement standards (for distinguishing procurement from subawards), the Subrecipient Monitoring dictionary term, and Prime Recipient vs. Subrecipient for how obligations divide between the two parties across the life of the award.