Management Decisions and Federal Agency Audit Follow-Up Under 2 CFR 200.521

The audit report does not close a Single Audit finding. A finding is closed when the federal agency or pass-through entity that funds the program issues a management decision and the auditee carries out the corrective action. The CPA firm's work ends earlier, but a firm that understands what happens next writes better findings and gives clients better advice.

This guide explains who issues a management decision, what it contains, the six-month timeline and how it ties to the auditee's own documents. It paraphrases 2 CFR 200.521 and 200.332; read the regulations for exact wording.

What a management decision is

A management decision is the written response of the federal agency or pass-through entity to an audit finding. It states whether the finding is sustained and what the auditee is expected to do about it. It is the point where the finding stops being an auditor's observation and becomes a directed obligation.

Under 2 CFR 200.521, the decision must contain:

• A clear statement of whether the audit finding is sustained, with the reasons.
• The expected auditee action to repay disallowed costs, make financial adjustments or take other action.
• The reference number the auditor assigned to each finding, so the decision connects to the audit report.

The regulation adds two items it says the decision should include: a timetable for follow-up if the auditee has not completed corrective action, and a description of any appeal process available to the auditee.

Before issuing the decision, the agency or pass-through entity may request additional information or documentation from the auditee, including auditor assurance on that documentation, as a way of mitigating disallowed costs.

Who issues the decision

Which party decides depends on whose money the finding touches.

• The awarding federal agency issues the decision on findings that relate to its own federal awards.
• The pass-through entity issues the decision on findings that relate to subawards it made to subrecipients.
• The cognizant agency for audit coordinates decisions on findings that affect the programs of more than one federal agency.

For a subrecipient auditee, the practical result is that several pass-through entities may each issue decisions on findings that relate to their own subawards. A single finding in a subrecipient's report can generate more than one decision letter.

The six-month timeline

The responsible federal agency or pass-through entity is required to issue its decision within six months of the FAC accepting the audit report. The auditee, for its part, must proceed with corrective action as rapidly as possible, and corrective action should begin no later than receipt of the audit report. The auditee's corrective action does not wait for the decision.

This is why the corrective action plan has to be specific. A plan that names the owner, the action and the date can be matched against the decision's timetable. A plan that is vague forces the agency to ask follow-up questions, which uses the six months. See the corrective action plan guide.

What a pass-through entity does with a subrecipient's audit

Pass-through entity responsibilities sit in 2 CFR 200.332 and run in parallel to the decision requirement. For subrecipients, the pass-through entity:

• Verifies that the subrecipient is audited as subpart F requires.
• Reviews the subrecipient's audit findings that relate to the subaward and issues a management decision for findings that pertain only to the federal award it provided.
• Resolves audit findings specific to the subaward.
• Is not responsible for resolving cross-cutting findings, meaning findings that affect multiple awards.

Where a subrecipient has a current Single Audit and is not debarred or suspended, the pass-through entity may rely on the subrecipient's cognizant or oversight agency for audit to deal with cross-cutting findings. That reliance does not remove the pass-through entity's other duties: it still evaluates risk, monitors the subaward and tracks findings that relate to it.

Pass-through entities can also adjust their own records based on audit and monitoring results, and may apply enforcement tools to noncompliant subrecipients. The remedies are listed in 2 CFR 200.339 and range from withholding payments to terminating the award.

How decisions connect to the next audit

Management decisions feed forward.

• The summary schedule of prior audit findings. The next audit's summary schedule reports the status of each finding. Under 2 CFR 200.511 an auditee may treat a finding as invalid or not warranting action only when two years have passed since the report went to the FAC, the agency or pass-through entity is not following up, and no management decision has been issued. A management decision defeats the third condition, so a finding with a decision cannot be dropped on the basis of time alone.
• Questioned costs. If the decision disallows costs, the auditee repays or adjusts. The next year's auditor needs to see the repayment and the accounting.
• Repeat findings. If the corrective action fails, the same condition appears again, and the finding must be identified as a repeat of the immediately prior audit.

Where auditors fit

The auditor does not issue or negotiate management decisions, and the audit team should not advise the agency on how to decide. The auditor's role is narrower and still real.

1. Write findings that support a decision. The finding elements in 2 CFR 200.516 (criteria, condition, cause, effect, questioned costs, prevalence, repeat status, recommendations and auditee views) are designed so that an agency can decide. A finding that omits the cause or the questioned costs gives the agency nothing to sustain. See writing findings.
2. Test the summary schedule. The auditor reports when follow-up procedures show that the auditee's summary schedule materially misrepresents the status of a prior finding.
3. Keep reference numbers stable. The decision cites the auditor's number. Renumbering between draft and final creates confusion that persists for years.

Advice for clients

• Treat a decision letter as a deadline document. Calendar the timetable it sets.
• Keep evidence of every corrective step. The next auditor will ask for it, and so will the agency.
• If a decision disallows costs and the auditee disagrees, use the appeal process the decision describes. Do not simply let the matter lapse.
• Send each decision letter to the audit firm. The firm needs it for the next year's follow-up procedures.

Related reading

For the full engagement sequence see the Single Audit walkthrough. For pass-through duties in detail see the subrecipient monitoring standards page.

CORAA prepares ready-to-review audit files for US CPA firms, including prior-finding follow-up lists. The firm keeps the client, the review and the signature. See /us.

Sources

• Legal Information Institute, 2 CFR 200.521, Management decisions: https://www.law.cornell.edu/cfr/text/2/200.521
• Legal Information Institute, 2 CFR 200.332, Requirements for pass-through entities: https://www.law.cornell.edu/cfr/text/2/200.332
• Legal Information Institute, 2 CFR 200.511, Audit findings follow-up: https://www.law.cornell.edu/cfr/text/2/200.511
• Legal Information Institute, 2 CFR 200.516, Audit findings: https://www.law.cornell.edu/cfr/text/2/200.516
• Legal Information Institute, 2 CFR 200.339, Remedies for noncompliance: https://www.law.cornell.edu/cfr/text/2/200.339

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error