Subrecipient Monitoring Checklist (200.332)

Under 2 CFR §200.332, an organization that passes federal grant funds through to a subrecipient (a “pass-through entity,” or PTE) does not get to walk away once the subaward agreement is signed. The PTE remains accountable to the federal awarding agency for how those funds are used, which means it must evaluate a subrecipient’s risk before making the subaward, monitor the subrecipient’s performance and spending throughout the period of performance, and follow up on any audit findings that turn up along the way. This guide walks through each obligation in order and ends with a practical checklist a research administration or sponsored-programs office can use directly.

Who this applies to

The obligations below apply to any non-federal entity that makes a subaward of federal funds it received under a federal grant or cooperative agreement — most commonly a university, hospital, or research institute passing funds to a collaborating institution named in the proposal. They apply regardless of the subaward’s payment structure (cost-reimbursement or fixed-amount) and regardless of dollar size, though the intensity of monitoring is explicitly meant to scale with risk, not applied uniformly. See the CASRAI Subaward term for the underlying definition, and Subrecipient vs. Contractor vs. Vendor for the threshold question of whether 2 CFR 200.332 even applies to a given relationship — contractors and vendors are procurement relationships governed by different Uniform Guidance sections (200.317-200.327), not subrecipient monitoring.

Before the subaward: risk assessment (2 CFR 200.332(c))

Before it makes a subaward, a pass-through entity must evaluate each proposed subrecipient’s risk of noncompliance for purposes of determining the appropriate level of subsequent monitoring. 2 CFR 200.332(c) names four factors the PTE must consider:

Prior experience with the same or similar subawards. Has this subrecipient successfully administered comparable federal subawards before, from this PTE or elsewhere?
Results of previous audits. This includes whether the subrecipient has been subject to a Single Audit, and whether awards similar to the one being made were reviewed as part of that audit’s major-program testing.
Whether the subrecipient has new personnel or new or substantially changed systems. A subrecipient with a recent change in its financial-management system or key administrative staff carries more risk than one with stable, proven systems.
The extent and results of any federal agency monitoring. If the subrecipient also receives funding directly from a federal agency, that agency’s own oversight history is relevant evidence of the subrecipient’s compliance posture.

This assessment doesn’t have to be elaborate, but it does have to be documented — the risk determination is what justifies the monitoring plan the PTE puts in place for that specific subrecipient. A first-time subrecipient with no Single Audit history, or one flagged by a prior finding, should reasonably trigger a higher level of monitoring than an established collaborator with a clean audit record.

Separately, at the time it makes the subaward, the PTE must also flow down all applicable federal award requirements to the subrecipient and communicate specific subaward information (Federal award identification, applicable indirect cost rate treatment, and other terms). On indirect costs specifically: a pass-through entity must accept a subrecipient’s existing federally negotiated indirect cost rate and cannot compel the subrecipient to use the de minimis rate instead; a subrecipient with no current negotiated rate may elect the de minimis rate or negotiate one with the PTE.

Setting monitoring intensity to match risk

2 CFR 200.332 does not prescribe a single fixed monitoring procedure for every subaward — it requires the PTE to monitor “as necessary” based on the risk evaluation above. In practice, that means a low-risk, experienced subrecipient with a strong audit history might receive standard periodic report review, while a higher-risk subrecipient (new to federal funding, recent findings, changed systems, or simply a large dollar award) warrants more frequent report review, targeted follow-up questions, and an on-site or virtual site visit during the period of performance rather than only at closeout.

Ongoing monitoring during the period of performance (2 CFR 200.332(e)-(f))

Once the subaward is active, 2 CFR 200.332(e) requires the pass-through entity to:

Review financial and performance reports the subrecipient submits, checking them against the approved budget, scope of work, and reporting schedule — not simply filing them.
Follow up on significant developments, including ensuring the subrecipient takes timely and appropriate corrective action on deficiencies identified through audits, on-site reviews, or other monitoring.
Issue a management decision for audit findings pertaining to the federal award that flows through the subaward, and resolve audit findings specifically related to the subaward itself (a PTE may rely on a cognizant or oversight agency for cross-cutting findings that reach beyond a single award).

2 CFR 200.332(f) lists additional monitoring tools a PTE may use depending on the risk level, including:

Providing subrecipients with training and technical assistance on program-specific and administrative/financial requirements;
Performing on-site reviews of the subrecipient’s program operations;
Arranging for agreed-upon-procedures engagements as described in 2 CFR 200.425.

None of these tools is mandatory for every subaward — they’re the toolkit a PTE draws from in proportion to the risk level it documented before making the award. A higher-risk subrecipient is where a PTE should actually schedule a site visit or require more frequent interim reporting; applying the same light-touch monitoring to every subrecipient regardless of risk is itself a compliance gap an auditor or federal awarding agency can flag.

Following up on audit findings

Subrecipient monitoring doesn’t end when a report is filed or a site visit is completed — it includes closing the loop on anything that monitoring turns up. Where a subrecipient’s own Single Audit (required once it expends $1,000,000 or more in federal awards in a fiscal year) produces a finding related to the PTE’s subaward, the PTE is responsible for issuing a management decision and confirming the subrecipient has taken corrective action, not merely noting the finding exists. See the CASRAI guides on the Federal Audit Clearinghouse (FAC) submission process and Single Audit reporting package structure for how those findings surface in the first place, and internal controls under 2 CFR 200.303 for the broader control environment this monitoring sits inside.

A practical subrecipient monitoring checklist

The list below sequences the obligations above into a working checklist for a sponsored-programs or research-administration office.

Before the subaward is issued:

Confirm the relationship is genuinely a subaward, not a procurement contract — see Subrecipient vs. Contractor vs. Vendor and 2 CFR 200.331’s substance-over-form test.
Document the risk assessment against all four 200.332(c) factors: prior subaward experience, prior audit results, personnel/systems changes, and any existing federal agency monitoring of the subrecipient.
Confirm the subrecipient’s indirect cost rate treatment (existing negotiated rate, de minimis election, or a rate negotiated directly with the PTE) before the subaward budget is finalized.
Set the monitoring plan — reporting frequency, whether a site visit is warranted, and who on the PTE side owns follow-up — based on the documented risk level, and record it in the subaward file.
Flow down all applicable federal award terms and conditions into the subaward agreement itself.

During the period of performance:

Review each financial and performance/progress report against the approved budget and scope of work on receipt, not just before submission to the sponsor.
Track report due dates separately from the prime award’s own reporting deadlines — subrecipient deadlines are typically set earlier to allow time for compilation into the prime’s report.
Conduct an on-site or virtual site visit for higher-risk subrecipients, and document what was reviewed and any issues identified.
Offer training or technical assistance where a subrecipient’s reports or a site visit reveal a gap in understanding of federal requirements, rather than only citing noncompliance after the fact.
Log any significant development — a missed deadline, a budget variance, a personnel change, an audit finding — and track it through to resolution, not just to acknowledgment.

When an audit finding or significant issue surfaces:

Determine whether the finding relates to the federal award generally (management decision required from the PTE) or is specific to the subaward (resolution required from the PTE directly).
Issue a timely, written management decision describing whether the finding is sustained, what corrective action is required, and the timeline for that action.
Confirm the subrecipient has implemented the corrective action, not just proposed it, before considering the finding closed.
Retain the full documentation trail — risk assessment, monitoring records, correspondence, and finding resolution — per the institution’s record-retention schedule (2 CFR 200.334).

At subaward closeout:

Confirm all required final financial and performance reports have been received and reviewed.
Confirm any outstanding audit findings tied to the subaward have been resolved or have a documented resolution plan.
Complete closeout steps consistent with the PTE’s own closeout obligations under 2 CFR 200.344.

Common pitfalls

Treating the risk assessment as a one-time formality. An assessment that isn’t documented, or that doesn’t actually drive a different monitoring plan for higher-risk subrecipients, doesn’t satisfy 200.332(c) in substance even if a checkbox exists somewhere in the file.
Filing reports without reviewing them. Receiving a financial or performance report is not the same as reviewing it against the budget and scope of work; only the latter satisfies 200.332(e)(1).
Confusing subrecipient monitoring with procurement oversight. A vendor or contractor relationship is governed by the procurement standards (2 CFR 200.317-200.327), not 200.332 — applying subrecipient-monitoring paperwork to a contractor, or vice versa, misapplies both frameworks.
Not closing the loop on findings. Noting an audit finding without issuing a management decision or confirming corrective action leaves the PTE’s own compliance exposure open, since the PTE (not just the subrecipient) is accountable to the federal awarding agency.

Frequently asked questions

Is subrecipient monitoring required for every subaward, regardless of size?

Yes — 2 CFR 200.332 applies to subawards of federal funds generally, without a dollar-size exemption. What changes with size and risk is the intensity of monitoring the pass-through entity applies, not whether the underlying risk-assessment and monitoring obligations exist at all.

Does a subrecipient’s own Single Audit satisfy the pass-through entity’s monitoring obligation?

No. A subrecipient’s Single Audit (where applicable, at $1,000,000+ in annual federal expenditures) is one input into the PTE’s risk assessment and a source of findings the PTE must follow up on — it does not substitute for the PTE’s own ongoing monitoring of reports, corrective actions, and (where risk warrants) site visits during the period of performance.

What’s the difference between a subrecipient and a contractor for monitoring purposes?

2 CFR 200.331 sets out a substance-over-form test: a subrecipient carries out a portion of the federal award’s programmatic effort and is measured against the award’s objectives, while a contractor provides goods or services within its normal business operations for the PTE’s own use. Only subrecipient relationships trigger 200.332 monitoring; contractor relationships are governed by the procurement standards instead. See Subrecipient vs. Contractor vs. Vendor for the full test.

Who is responsible for resolving an audit finding tied to a subaward — the subrecipient or the pass-through entity?

Both, in different roles. The subrecipient is responsible for implementing corrective action. The pass-through entity is responsible for issuing the management decision on findings related to the federal award and for resolving findings specific to the subaward — the PTE remains accountable to the federal awarding agency even though the underlying deficiency sits with the subrecipient.

For the underlying regulatory framework this checklist implements, see the CASRAI guides on subaward agreement negotiation and 2 CFR 200 procurement standards (for distinguishing procurement from subawards), the Subrecipient Monitoring dictionary term, and Prime Recipient vs. Subrecipient for how obligations divide between the two parties across the life of the award.