Subrecipient Monitoring: 2 CFR 200.332 Steps and Checklist

Full answer: Under 2 CFR 200.332, a pass-through entity must assess subrecipient risk, put required terms in the subaward, monitor to match that risk, and act on findings. It must also verify audit status. Start by documenting why the partner is a subrecipient and not a contractor under 2 CFR 200.331. The award and documented risk assessment determine the monitoring plan.

Subrecipient Monitoring for Federal Grants: The Complete 200.332 Guide (2026)

Data note: Checked July 26, 2026 against current 2 CFR 200.331, 2 CFR 200.332, 2 CFR 200.414, and 2 CFR 200.501. Verify agency and award-specific requirements before issuing or monitoring a subaward.

If your organization passes federal grant funds to other entities through subawards, you're a pass-through entity, and subrecipient monitoring is one of your most important compliance obligations. It's also one of the most frequently cited areas of noncompliance in federal audits.

Who this is for: grants managers, sponsored programs administrators, compliance officers, and finance directors at organizations that issue subawards using federal grant funds. If you manage relationships with subrecipients or are building a monitoring program, this guide covers the requirements under 2 CFR 200.332 and the practical steps for meeting them.

Organizations that monitor subrecipients well treat it as relationship management, not just compliance paperwork. Here's how to build a monitoring program that actually works.

Last updated: July 26, 2026

Grantsights Source Review and Decision Evidence

Source review by Grantsights. Editorial accountability: this page was refreshed against current eCFR Uniform Guidance sections, Federal Audit Clearinghouse, and SAM.gov materials on June 3, 2026.

Decision checklist: document the relationship type, collect UEI and award identifiers, complete a pre-award risk review, set monitoring intensity by risk, verify audit status, issue management decisions on findings, and keep evidence of follow-up.

According to 2 CFR 200.331, subrecipient and contractor determinations depend on characteristics such as program responsibility, eligibility decisions, and use of funds. According to 2 CFR 200.332, pass-through entities must identify required federal award information to the subrecipient and monitor activities as needed to ensure compliance. According to 2 CFR 200.501, audit requirements apply based on federal expenditures during the fiscal year. According to FAC, federal audit submissions can be searched and used to verify audit status.

Our analysis: the audit finding usually starts in the first week of the relationship, when the agreement lacks required fields or the team never documents why the partner is a subrecipient. A clean monitoring file should show the classification memo, risk review, subaward terms, invoice checks, program reports, audit check, and any corrective action. For live grant and subaward context, use the Grantsights grant database. For help building review workflows, see Grantsights pricing.

What official sources miss

Based on our analysis of 2 CFR 200.331, 200.332, 200.501, FAC, and SAM.gov, the winner pattern is a monitoring file that tells the whole story. According to 2 CFR 200.332, pass-through entities must evaluate risk and monitor subrecipient activities as needed to ensure compliance. According to 2 CFR 200.501, audit requirements depend on federal expenditures during the fiscal year. According to FAC, audit submissions are available through the federal clearinghouse.

Bad fit: do not use a standard vendor checklist for a true subrecipient. For example, one university passing federal research funds to another university should document subrecipient classification, required award fields, invoice review, programmatic reporting, and audit verification before closeout.

---

The First Decision: Subrecipient or Contractor?

Before you can monitor anything, you need to correctly classify the relationship. This is the single most consequential compliance decision in subaward management, and section 200.331 provides the framework.

Characteristics of a Subrecipient

A subrecipient:

• Determines who's eligible to receive what the program provides
• Has performance measured against whether the federal program's objectives are met
• Has responsibility for programmatic decision making
• Is responsible for adherence to applicable federal program requirements
• Uses federal funds to carry out a program, not to provide goods or services to the pass-through entity

Characteristics of a Contractor

A contractor:

• Provides goods and services within normal business operations
• Provides similar goods or services to many different purchasers
• Normally operates in a competitive environment
• Provides goods or services that are ancillary to the federal program
• Is not subject to compliance requirements of the federal program as a result of the agreement

Why This Matters

Getting this classification wrong creates cascading problems. If you treat a true subrecipient as a contractor, you won't conduct required monitoring, won't verify their audit status, and won't include required federal award information in the agreement. Auditors look at the substance of the relationship, not the label you put on it.

What 200.331 Doesn't Tell You

The regulation provides characteristics but doesn't give you a bright-line test. In practice, many relationships have characteristics of both. A university hiring another university to run a specific component of a research project is almost always a subaward. A university hiring a lab to run specific assays on samples is almost always a contract. But there's a gray area in between, and the regulation doesn't address it well.

Document your determination for every external relationship over $25,000. Write down which characteristics apply and why you reached your conclusion. If you're on the fence, classify it as a subaward. Over-monitoring is a far less serious problem than under-monitoring.

---

The 6 Requirements of 200.332

Section 200.332 lays out what pass-through entities must do. Here are the six core requirements:

1. Assess Subrecipient Risk

Before issuing a subaward and periodically thereafter, you must evaluate each subrecipient's risk of noncompliance. The UG lists factors to consider:

• Prior experience with the same or similar subawards
• Results of previous audits (including Single Audits)
• Whether the subrecipient has new personnel or new or substantially changed systems
• The subrecipient's financial stability
• Adequacy of the subrecipient's internal controls and compliance policies

Document the risk assessment in writing and assign a risk level (typically high, medium, or low). This risk level drives the intensity of your monitoring activities.

Practical tip: Don't treat the risk assessment as a one-time event. Reassess annually and whenever significant changes occur, like turnover in key financial positions or a change in the subrecipient's organizational structure.

2. Include Required Information in the Subaward Agreement

Your subaward agreement must include all elements listed in 200.332(a). This is a long list, and missing any element is a finding. The required elements include:

• Subrecipient name (must match SAM.gov registration)
• Subrecipient's Unique Entity Identifier (UEI)
• Federal Award Identification Number (FAIN)
• Federal award date
• Subaward period of performance start and end dates
• Subaward budget (total amount and amount obligated)
• Federal award project description
• Name of federal awarding agency, pass-through entity, and contact information
• CFDA number and name
• Identification of whether the award is R&D
• Indirect cost rate (negotiated rate or de minimis 15%)
• All applicable compliance requirements
• Requirement for the subrecipient to permit access to records
• Appropriate terms and conditions regarding closeout

Use a subaward agreement template that includes all these elements as standard fields. Don't rely on individual staff to remember every item.

3. Monitor Subrecipient Activities

This is the heart of subrecipient monitoring. The UG requires monitoring sufficient to ensure the subrecipient uses funds for authorized purposes, complies with federal statutes and regulations, and achieves performance goals.

Monitoring activities should be calibrated to risk:

Desk reviews involve requesting and examining source documentation for a sample of charges on the subrecipient's invoices. Ask for timesheets, receipts, procurement documentation, and other backup. Compare what you see against the approved budget and the allowable costs standards.

On-site visits involve physically going to the subrecipient's location (or conducting a virtual site visit) to review their systems, interview staff, and examine records that aren't practical to transmit electronically.

4. Verify Single Audit Compliance

You must verify audit status for subrecipients that meet the current Single Audit threshold of $1 million in federal awards expended during their fiscal year. Check the Federal Audit Clearinghouse for submissions.

If the subrecipient's audit reveals findings related to your subaward, you must:

• Evaluate the findings and the subrecipient's corrective action plan
• Issue a management decision within 6 months
• Follow up to confirm corrective actions are implemented

For subrecipients below the Single Audit threshold, consider whether other monitoring activities (like desk reviews or agreed-upon procedures) are needed to provide adequate assurance. The absence of a Single Audit requirement doesn't mean the absence of a monitoring requirement.

5. Use Remedies for Noncompliance

When monitoring reveals problems, you need to take action. Available remedies include:

• Imposing additional conditions on the subaward (more frequent reporting, prior approval for expenditures)
• Temporarily withholding payment pending resolution
• Disallowing costs that are unallowable or inadequately documented
• Suspending or terminating the subaward
• Initiating suspension or debarment proceedings

Document every instance of noncompliance and every corrective action you require. Create a timeline for resolution and follow up until the issue is closed. Auditors will ask to see your documentation of identified problems and your response.

6. Consider Imposing Specific Conditions

For higher-risk subrecipients, the UG allows pass-through entities to impose specific conditions beyond the standard terms. These might include:

• Requiring payment on a reimbursement basis only (no advances)
• Additional or more detailed financial reports
• Additional project monitoring
• Requiring the subrecipient to obtain specific technical or management assistance
• Establishing additional prior approvals

The key is proportionality. Specific conditions should match the identified risk, and you should remove them when the subrecipient demonstrates compliance.

---

Building a Subrecipient Monitoring Plan

A monitoring plan should be a written document that describes your organization's approach. Here's a template structure:

Policy statement: Our organization monitors all subrecipients in accordance with 2 CFR 200.332 to ensure proper stewardship of federal funds.

Risk assessment process:

• When assessments are conducted (pre-award and annually)
• Who conducts them (grants office, PI, both)
• What factors are evaluated
• How risk levels are assigned
• How assessments are documented

Monitoring activities by risk level:

• Low risk: specific activities and frequency
• Medium risk: specific activities and frequency
• High risk: specific activities and frequency

Audit verification:

• How and when audit reports are obtained
• Who reviews findings
• Management decision process and timeline

Noncompliance procedures:

• How issues are identified and documented
• Escalation procedures
• Available remedies
• Documentation requirements

Record retention:

• What records are maintained
• Retention period (minimum 3 years from final report, per grant records retention rules)
• Storage location

---

Common Subrecipient Monitoring Mistakes

Treating Monitoring as Optional

Some organizations issue subawards and then do nothing until the subrecipient submits an invoice. That's not monitoring. The UG requires proactive oversight, and the absence of monitoring is itself a compliance violation, regardless of whether the subrecipient is actually misusing funds.

Failing to Conduct Risk Assessments

Risk assessments must happen before the subaward is issued and periodically during the subaward period. A blanket policy of treating all subrecipients the same doesn't meet the risk-based monitoring requirement.

Not Checking Audit Status

Many pass-through entities forget to verify whether their subrecipients are completing required Single Audits. If a subrecipient is above the threshold and hasn't submitted an audit, that's a problem you need to address. Check the Federal Audit Clearinghouse annually for each subrecipient.

Using the Wrong MTDC Subaward Treatment

Under the current 2 CFR 200.1 MTDC definition, the first $50,000 of each subaward is included in the MTDC base once, regardless of the subaward's period of performance. The award's indirect-cost terms still control the applicable rate and any cap. Do not use the former $25,000 treatment.

Not Flowing Down Requirements

Your subaward agreement must flow down all applicable federal grant compliance requirements from your prime award. If your award has specific reporting requirements, cost restrictions, or programmatic conditions, those must appear in the subaward agreement. A generic subaward template without award-specific terms is insufficient.

---

Where Subrecipient Monitoring Goes Wrong

The fundamental problem with subrecipient monitoring as the UG frames it is that it puts the monitoring burden on the entity least equipped to handle it. Small nonprofits that receive a federal grant and subaward a portion to a partner often don't have dedicated compliance staff. They're expected to conduct risk assessments, verify audits, perform desk reviews, and issue management decisions on audit findings. That's a lot to ask from an organization whose entire staff might be five people.

The result is that monitoring either doesn't happen (creating compliance risk) or becomes a perfunctory paperwork exercise that doesn't actually provide meaningful oversight. Monitoring checklists can end up completed by checking every box without anyone examining a single document.

What would work better: a tiered approach based on the pass-through entity's capacity and the dollar amount of the subaward. A $30,000 subaward to a community partner doesn't warrant the same monitoring intensity as a $2 million in FY2025 subaward to a research institution. The UG allows for risk-based monitoring, but it doesn't explicitly acknowledge that the pass-through entity's capacity should be part of the equation.

---

The Subrecipient Monitoring Failures That Actually Show Up in Audits

The failures aren't usually dramatic. They're documentation failures and timing failures that pile up into findings because no one is watching the process systematically. A common finding is subaward agreements that are missing required elements under 200.332(a), such as the indirect cost rate and the CFDA number. These aren't obscure requirements. They're in black and white in the regulation. But when agreements are generated by a sponsored programs office using a template that hasn't been updated since the 2020 Uniform Guidance revision, required fields don't make it into the document, and auditors check for them.

The current $1 million Single Audit threshold creates a monitoring decision, not a monitoring exemption. A subrecipient below that threshold may not have a Single Audit, but the pass-through still must monitor as needed to provide reasonable assurance of compliance. A targeted desk review can be an appropriate risk response when the risk assessment identifies incomplete support, new systems, or a history of findings.

The subrecipient versus contractor distinction is where classification errors tend to be most consequential. The regulation at 200.331 provides characteristics, not a bright-line test, and organizations in the gray zone often make the classification based on what's administratively convenient rather than what the relationship actually looks like. A common error is classifying community-based organizations that run program activities as contractors to avoid the monitoring requirements, even when the work clearly qualifies as subrecipient work. If those "contractors" later have audit findings and the federal awarding agency reviews the relationships, the misclassification becomes a separate compliance problem on top of the underlying expenditure issues.

The risk assessment process is supposed to be the mechanism that calibrates monitoring intensity, but organizations can reduce it to a checkbox exercise: assigning every new subrecipient "medium risk" regardless of its actual profile, then applying the same monitoring activities to a $5 million research institution subaward and a $35,000 community partner subaward. Meaningful risk assessment means asking whether this specific organization has had audit findings, whether their leadership has changed, whether their financial systems can actually track federal funds separately, and whether they have experience with the specific compliance requirements attached to this award. That takes more than five minutes, and it doesn't happen at organizations where grants managers carry portfolios of 80-plus subawards.

---

Related Guides

• Grant Audit Preparation
• What Is a Subaward in Federal Grants? Complete Guide

---

Sources

• 2 CFR 200.331-200.332, eCFR (current text)
• OMB Office of Federal Financial Management
• Federal Audit Clearinghouse, facweb.census.gov
• Government Accountability Office, "Federal Grants Management: Improvements Needed in Oversight of Single Audit Process" (GAO-23-105458)
• National Council of University Research Administrators (NCURA), Subrecipient Monitoring Best Practices Guide