Federal Grant Compliance Requirements: What to Know

Federal grant compliance requirements aren't optional fine print. They're legally binding obligations attached to every dollar of federal financial assistance your organization receives. If you don't know what 2 CFR Part 200 requires, you're already behind.

This guide breaks down the core federal grant compliance requirements so you know exactly what's expected, what changed in 2024, and what happens when things go wrong. If you're new to federal funding, our complete federal grants guide covers program types, eligibility, and the full application process before you get to compliance.

Source Review by Grantsights

Checked June 2026.

Grantsights rechecked this page against the live Uniform Guidance, the Federal Audit Clearinghouse, the HHS OIG Single Audit FAQ, and the OMB 2024 update trail. According to 2 CFR Part 200 (opens in a new tab), federal recipients must meet administrative, cost, and audit requirements across the award lifecycle. According to 2 CFR 200.501 (opens in a new tab), the current Single Audit trigger is $1,000,000 in federal awards expended. According to the HHS OIG Single Audit FAQ (opens in a new tab), OMB raised the threshold from $750,000 to $1,000,000 for audit periods covered by the 2024 update. According to the Federal Audit Clearinghouse (opens in a new tab), Single Audit reporting packages are submitted through FAC.

A common bad fit is not a small recipient below the audit threshold. It is an organization that crosses $1,000,000 in expenditures but still treats procurement, subrecipient monitoring, and property records as grant-by-grant paperwork. For example, one nonprofit that spends $400,000 under each of three pass-through awards in the same fiscal year would cross the audit line even though no single award looks large enough by itself.

Decision checklist:

What Official Sources Don't Tell You

Official rules tell you what compliance requires, but they do not tell you when a recipient is about to become an audit-risk account. The practical gap is portfolio behavior: awards that look manageable alone can create a federal-spend pattern that needs earlier controls. Use the Grantsights database to find federal programs by agency, and the free eligibility checker to see which of them fit your organization before you take on their compliance terms.

---

The Core Framework: 2 CFR Part 200 (Uniform Guidance)

The regulation that governs nearly all federal grant compliance requirements is 2 CFR Part 200, formally titled the "Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards." In practice, it's called the Uniform Guidance (UG).

OMB published the Uniform Guidance in final form in December 2013, with an effective date of December 26, 2014. Before that, eight separate OMB circulars governed different types of recipients:

• A-21 (universities)
• A-87 (state and local governments)
• A-102 (state and local governments, grants management)
• A-110 (nonprofits)
• A-122 (nonprofits, cost principles)
• A-133 (audits)
• A-50 (audit follow-up)
• A-89 (catalog of assistance)

The Uniform Guidance consolidated all of these into a single regulation. That was a significant simplification, even if the resulting document is still dense.

Who must comply: The Uniform Guidance applies to all non-federal entities receiving federal financial assistance. That includes:

• Nonprofits
• State and local governments
• Tribal governments
• Universities and higher education institutions
• Hospitals
• For-profit entities (with some differences in treatment)

It doesn't matter whether you receive funds directly from a federal agency or through a state agency that received federal funds. If federal money is flowing to you, the Uniform Guidance applies.

One critical point on agency authority: Federal agencies implement the UG through their own regulations. The UG sets a minimum floor. Individual agencies can add requirements on top of it. Always read your Notice of Award (NOA) carefully, because it will contain agency-specific requirements beyond what the UG mandates.

---

The 2024 Update to 2 CFR 200 (Effective October 1, 2024)

The 2024 revision to the Uniform Guidance made several changes that every grantee should know. If you're still operating under the pre-October 2024 thresholds, you need to update your policies.

1. De minimis indirect cost rate increased from 10% to 15% of Modified Total Direct Costs (MTDC)

Organizations without a current negotiated indirect cost rate (an expired rate counts as no current rate) can now claim up to 15% of MTDC as their indirect costs, up from 10%. This is a meaningful increase for smaller organizations that don't have the administrative capacity to negotiate a rate with their cognizant federal agency.

2. Single Audit threshold increased from $750,000 to $1,000,000 in annual federal expenditures

This is probably the most widely discussed change. Organizations that expend less than $1,000,000 in federal awards in a fiscal year are no longer required to undergo a Single Audit under the current threshold. That's a real cost savings for mid-sized grantees, though you'll still need to maintain records and comply with all other requirements.

3. Micro-purchase threshold adjustments

The micro-purchase threshold, which governs when you can buy goods and services without competitive bidding, was adjusted. 2 CFR 200.1 ties it to the FAR threshold, which is now $15,000, and under 2 CFR 200.320 (opens in a new tab) a recipient can self-certify a higher threshold of up to $50,000 if it meets that section's requirements. Always verify the current threshold in your organization's procurement policy and confirm it matches the current UG text at ecfr.gov (opens in a new tab).

4. Strengthened subaward monitoring requirements

Pass-through entities now face clearer documentation requirements for subrecipient monitoring. This isn't a new concept, but the 2024 revision made expectations more explicit.

5. Updated internal controls documentation standards

The revision added specificity around what "adequate internal controls" means in practice, drawing more explicitly from established frameworks like COSO and the Green Book.

---

The 5 Major Federal Grant Compliance Areas

Federal grant compliance requirements group into 5 broad areas. Each one is a potential audit finding if you're not managing it correctly.

1. Financial Management

Your accounting system must be able to do one fundamental thing: show exactly where every federal dollar came from and where it went, separately from your organization's other funds.

The UG specifies several financial management standards:

• Segregation of duties: The person who approves expenditures shouldn't be the same person who processes payments. This is a basic internal control that auditors look for.
• Documentation standards: Every expenditure needs supporting documentation - invoices, receipts, timesheets, purchase orders. "We spent it" isn't sufficient.
• Accrual accounting: You must use accrual accounting or be able to convert your records to accrual basis for reporting.
• Cash management: You can't draw down federal funds and let them sit in your bank account. The Cash Management Improvement Act (CMIA) requires minimizing the time between drawdown and expenditure.
• Budget controls: You must track spending against your approved budget by category and identify any significant deviations.

Record retention: Federal grant records generally must be retained for 3 years from the date of submission of the final financial report. Property, indirect-cost, program-income, and unresolved-matter rules can extend that period. Check your specific award terms.

2. Procurement

Purchases under a federal award must follow the applicable procurement standards, your documented procedures, and the award terms. Not every purchase requires a formal bid, but the file must support the method, reasonableness, and any required approval.

The UG establishes 4 purchase thresholds:

• Micro-purchases: Follow the current micro-purchase threshold and your procedures; distribute purchases equitably among qualified suppliers when practicable.
• Small purchases: Follow the applicable simplified-acquisition threshold and obtain quotations from an adequate number of qualified sources.
• Sealed bids and competitive proposals: Use the method appropriate to the purchase and project circumstances, with the required public solicitation, evaluation, and documentation.

Conflicts of interest: No employee can participate in selecting, awarding, or administering a contract with a vendor in which they have a personal financial interest. This includes family members. You need a written conflict of interest policy and you need to enforce it.

3. Property Management

Equipment purchased with federal funds isn't really yours during the period of performance. You're stewards of it. The UG has specific requirements for how you manage it.

• Property tracking system: You must maintain a list of all equipment purchased with federal funds, including description, serial number, funding source, acquisition date, and cost.
• Physical inventory: Complete a physical inventory of equipment at least once every 2 years and reconcile the results with property records.
• Use restriction: Equipment must be used for the project it was purchased for during the project period. Using grant-funded computers for other programs without approval is a compliance issue.
• Disposition: When equipment is no longer needed, apply 2 CFR 200.313 and the award terms. Recipient- or subrecipient-owned equipment with current per-unit fair market value of $10,000 or less may generally be retained, sold, or otherwise disposed of with no further responsibility; higher-value equipment follows the applicable disposition process.

4. Reporting

Federal grant reporting requirements fall into 2 categories: financial reports and performance reports. Both must be submitted on time. For a detailed breakdown of report types and deadlines, see Federal Grant Reporting Requirements.

The standard financial report is the SF-425 (Federal Financial Report). It covers cumulative expenditures, unliquidated obligations, and your unobligated balance.

• Interim reports: follow the frequency and due date in the award, subject to the 2 CFR 200.328 baseline
• Final reports: a recipient generally has 120 calendar days after the period of performance ends, while a subrecipient generally has 90 days to its pass-through entity unless an earlier date is agreed

Performance reports document what you accomplished. Format and frequency vary by agency - NIH uses the RPPR, NSF uses Research.gov, community-based agency grants often use program-specific reporting formats.

Subaward reporting: Determine whether current 2 CFR Part 170 and the award require subaward reporting, then use the system, threshold, exception, and due date specified by the federal agency or pass-through entity.

5. Subrecipient Monitoring

If you pass federal funds to other organizations, you're a pass-through entity. And pass-through entities have monitoring obligations that many organizations underestimate.

The UG requires pass-through entities to:

1. Conduct a pre-award risk assessment of each subrecipient
2. Execute a written subaward agreement that passes through all applicable federal requirements (including the UG itself)
3. Monitor subrecipient performance throughout the project period
4. Review subrecipient Single Audit findings when applicable
5. Verify that subrecipients are not listed on the SAM.gov exclusions list

Inadequate subrecipient monitoring is one of the most consistently cited findings in federal audits. Don't treat subrecipients as independent contractors. They're extensions of your federal award and you're responsible for their compliance.

---

The Single Audit

The Single Audit (formerly the A-133 Audit) is a full compliance examination that goes well beyond a standard financial statement audit.

Who requires it: Any entity that expends $1,000,000 or more in federal awards in a fiscal year. (This threshold increased from $750,000 effective October 1, 2024.)

What it covers: Two things simultaneously - your financial statements and your compliance with federal program requirements.

Who conducts it: An independent certified public accountant licensed in your state.

The Compliance Supplement: OMB publishes an annual Compliance Supplement that tells auditors exactly which compliance requirements to test for each federal program. If your program is listed in the Compliance Supplement, auditors know what to look for in your records.

Common audit findings include:

• Improper procurement (missing documentation, skipped competitive process)
• Unallowable costs (expenses that don't meet federal cost principles under 2 CFR 200 Subpart E)
• Inadequate internal controls (no segregation of duties, missing approvals)
• Late or inaccurate reporting
• Inadequate subrecipient monitoring

Audit findings go into the Federal Audit Clearinghouse (FAC), which is publicly accessible. Anyone can search for your organization's audit findings. Funders, federal agencies, and state agencies look at the FAC before making awards.

Repeat findings are treated much more seriously than first-time findings. A repeat finding in the same area across 2 consecutive audits signals that your organization isn't taking corrective action seriously.

---

FAPIIS and SAM.gov: What Stays on Your Record

FAPIIS, the Federal Awardee Performance and Integrity Information System, has been folded into SAM.gov. Under 2 CFR 200.206 (opens in a new tab), before making an award whose federal share is expected to exceed the simplified acquisition threshold, the agency must review the responsibility and qualification records in the non-public segment of SAM.gov.

What those records can include:

• Adverse actions including award terminations and suspensions
• Debarments and suspensions
• Significant performance failures

A history of compliance failures in those SAM.gov records doesn't automatically disqualify you from future awards, but it will trigger additional scrutiny and may result in award conditions (extra reporting requirements, pre-approval requirements) being attached to any new award.

Debarment: Listed on the SAM.gov exclusions list, debarment temporarily prohibits an organization from receiving any federal funding or from acting as a subrecipient. It's the most severe consequence of compliance failure. Debarments can range from months to years.

---

What Happens When You're Non-Compliant

Federal agencies have a graduated set of responses to compliance problems. They don't jump straight to termination.

Notice of specific conditions: Before imposing specific conditions, the agency or pass-through entity must tell you what the conditions are, why it's imposing them, what you need to do to remove them, how much time you have, and how to ask for reconsideration (2 CFR 200.208 (opens in a new tab)). This is often the first formal step in the enforcement process.

Heightened monitoring: More frequent reporting requirements, mandatory site visits, pre-approval requirements for certain expenditures. This can be applied proactively for new grantees or reactively after a compliance problem surfaces.

Award conditions: Additional requirements specific to your organization's known weaknesses, added to your NOA. These might include monthly rather than quarterly financial reports, required prior approval for budget changes, or mandatory training.

Suspension of funding: The agency stops processing your drawdown requests. You can't access funds until the compliance issue is resolved.

Award termination: The agency ends your award before the project period ends. This is rare but real. Terminated awards may trigger demands for repayment of improperly expended funds.

Debarment: Exclusion from all federal awards. This is the most serious consequence and is reserved for the most serious or repeated compliance failures.

The best strategy for dealing with compliance problems is to disclose them proactively to your program officer before they become audit findings. Agencies respond much better to grantees who identify problems and come with solutions than to grantees whose problems are discovered by auditors.

---

How to Build a Compliance System That Actually Works

You can't run federal grants on good intentions. You need documented policies and procedures that match the actual way your organization operates.

The basics every grantee needs:

• A written procurement policy that matches UG thresholds
• A conflict of interest policy covering procurement, employment, and financial decisions
• A property management policy and a physical inventory process
• Written time and effort reporting procedures (for any staff paid from federal funds)
• A record retention schedule that covers federal grant records
• An internal controls framework with documented segregation of duties

For organizations managing large federal portfolios, it's worth getting an independent pre-audit assessment - sometimes called a "mock audit" - from a CPA who specializes in federal grant compliance. The cost is far lower than the cost of a material finding.

For more on how indirect costs work within this compliance framework, see How to Calculate Your Indirect Cost Rate and Federal Grant Budget Categories Explained.

Related Guides

• EPA Grants
• NEA Grants
• Manage Multiple Grants
• 2 CFR 200 Uniform Guidance

---

What OMB's Website Doesn't Tell You About Federal Grant Compliance

The 2024 UG revision quietly changed how agencies handle indirect cost negotiations. Under 2 CFR 200.414(f) (opens in a new tab), a recipient without a current negotiated rate may use the de minimis rate indefinitely, until it chooses to negotiate a rate, and crossing $1 million in federal spending doesn't change that. A statute or your award terms can still set different rules, so read the notice of award.

Compliance findings don't always appear in your Single Audit. Program officers can flag issues during desk reviews that never reach your auditor but still affect future funding decisions. If you get a management decision letter, treat it with the same urgency as an audit finding.

Subrecipient monitoring requirements under 2 CFR 200.332 are where most organizations fall behind. The regulation lists specific steps, but in practice, federal reviewers expect documented evidence of ongoing monitoring, not just a signed subaward agreement. A monitoring visit log and corrective action tracker are minimum expectations.

---

What Compliance Audits Commonly Find

Here's what the regulations don't prepare you for.

A frequent finding isn't fraud. It's time-and-effort documentation. Inadequate effort reporting is a frequent source of questioned costs in university single audits. Faculty members split across multiple grants don't certify their effort on time, or the percentages don't match their institutional activity reports. The fix is simple but requires institutional discipline: effort certification every semester, with a hard deadline enforced by sponsored research. Late effort reports alone can produce a questioned cost finding, even when the money was spent properly and only the documentation was missing.

Cost transfers after 90 days are audit magnets. The 2024 Uniform Guidance revision didn't change this, but auditors have gotten stricter about it. If you're moving costs between grants more than 90 days after the expense, you need a written justification that explains why the transfer is legitimate and not a way to burn down an expiring budget. Untimely cost transfers alone can lead an agency to impose high-risk conditions on the next award cycle.

The de minimis rate increase to 15% is a trap for some organizations. When the 2024 revision raised the de minimis from 10% to 15%, many smaller nonprofits celebrated. But here's what nobody mentions: if your actual indirect costs are closer to 25-30% of MTDC (which is common for organizations with office rent and administrative staff), using the 15% de minimis means you're leaving 10-15% of recoverable costs on the table every year. For a $500,000 grant, that's $50,000 to $75,000 in unrecovered overhead. If that's your situation, negotiating a NICRA may recover significantly more than the de minimis. Negotiating a rate with your cognizant agency can take months, but the math often favors it once your federal spending is large enough to cover the cost of preparing a rate proposal.

---

Sources

• 2 CFR Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (opens in a new tab)
• Office of Management and Budget (OMB) (opens in a new tab)
• Government Accountability Office Yellow Book - Single Audit Requirements (opens in a new tab)

---

FAQ: Common Questions

What is 2 CFR 200 and who does it apply to?

2 CFR Part 200 is the OMB regulation known as the Uniform Guidance. It governs administrative requirements, cost principles, and audit requirements for all non-federal entities receiving federal financial assistance. That includes nonprofits, state and local governments, tribal governments, universities, hospitals, and for-profit entities. It applies to both direct recipients of federal awards and subrecipients who receive federal funds passed through a state agency or another organization.

What is the Single Audit threshold in 2024 through 2026?

The Single Audit threshold increased from $750,000 to $1,000,000 in annual federal expenditures, effective October 1, 2024. Organizations that expend less than $1,000,000 in federal awards in a fiscal year are not required to undergo a Single Audit. They may still be subject to program-specific audits depending on the terms of their awards.

How long must I keep federal grant records?

The general rule is 3 years from the date of submission of the final financial report for the award. However, several situations extend this period: if litigation, claims, or audit findings are unresolved at the end of the 3-year period, records must be kept until resolution. Property and equipment records must be kept for 3 years after final disposition. Under 2 CFR 200.334 (opens in a new tab), agencies can't impose other retention periods beyond the listed exceptions, though they can extend the period by written notice, so watch for one.

What happens if my organization fails a federal grant audit?

An audit finding doesn't automatically result in serious consequences. What matters is how you respond. Auditors expect a corrective action plan in response to findings, and they look at whether you've followed through in subsequent audits. First-time findings that are promptly addressed are treated very differently from repeat findings. Serious or material findings can result in heightened monitoring, award conditions on future grants, required repayment of funds, or, in the most extreme cases, debarment.

What is FAPIIS and how does it affect future grant applications?

FAPIIS (Federal Awardee Performance and Integrity Information System) has been folded into SAM.gov. Under 2 CFR 200.206, agencies must review the responsibility and qualification records in the non-public segment of SAM.gov before making an award whose federal share is expected to exceed the simplified acquisition threshold. Those records can include adverse actions such as terminations, suspensions, and debarments. A history of compliance problems there won't automatically disqualify your organization from future awards, but it will trigger closer scrutiny and may result in additional award conditions on any new award.