When a Single Audit client passes federal money to other organizations, the auditor tests whether the client monitored them. The compliance requirement is set by 2 CFR 200.332, and the requirement has several moving parts, each of which can fail separately.
This guide gives a testing structure. It paraphrases the regulation, and the audit procedures for a given program come from the Compliance Supplement in effect for the audit period. Start from the subrecipient monitoring standards page for the requirement itself and from the 200.331 determination guide for classification.
Step 1: Establish the population
Testing begins with the list of subawards, so the first procedure is completeness.
- Obtain the client's subaward listing for each major program with pass-through activity.
- Reconcile total amounts passed through on the listing to the amount shown as passed through to subrecipients on the SEFA.
- Reconcile the listing to the disbursement records for the grant, to find payees that are not on the list.
- Review the classification of any payee that appears in disbursements but not on the list. A subrecipient treated as a contractor is a population error.
A listing that does not agree to the SEFA is the first exception, and it needs resolution before the sample is drawn.
Step 2: Subaward information
Under 2 CFR 200.332(b), the pass-through entity must clearly identify to the subrecipient that the agreement is a subaward and include the required information. The information includes the subrecipient's name, matching the name registered with the unique entity identifier, and the other data elements the regulation lists. Where information is not available when the subaward is made, the pass-through entity gives the best available information and provides the remainder once it is obtained.
Test by selecting subawards and comparing each agreement to the regulation's list. The common exceptions are a missing Assistance Listing number, a subrecipient name that does not match its registration and a subaward not labeled as a subaward. Document each element checked, not only the conclusion.
Step 3: Risk evaluation
Under 2 CFR 200.332(c), the pass-through entity evaluates each subrecipient's fraud risk and risk of noncompliance with the subaward, and uses the result to determine the appropriate monitoring. The regulation names factors for the evaluation, including the subrecipient's prior experience with the same or similar subawards, the results of previous audits, whether the subrecipient has new personnel or new or substantially changed systems, and the extent and results of federal agency monitoring.
Test by asking for the risk evaluation for each selected subaward and checking three things:
- It exists and is dated before or at the time of the award. A risk assessment prepared after the audit begins is a weak control.
- It considers the listed factors. For example, if the prior-year audit report on the subrecipient had findings, the evaluation should reflect them.
- It drives the monitoring. A subrecipient rated high-risk should receive more monitoring than one rated low. If monitoring is identical for all, the evaluation is not doing its job.
Step 4: Monitoring activities
Under 2 CFR 200.332(e), the pass-through entity reviews financial and performance reports and ensures the subrecipient takes corrective action on all significant developments that negatively affect the subaward, including Single Audit findings related to the subaward, other audit findings and site visit results. Paragraph (f) lists tools that may be useful depending on the risk assessment: training and technical assistance, site visits and agreed-upon-procedures engagements.
For each sampled subaward, inspect the evidence of performance:
- Financial and performance reports received and reviewed, with the reviewer and date.
- Follow-up on reports that raised questions.
- Site visit or desk review documentation, if the monitoring plan called for it.
- Correspondence on any significant problem and its resolution.
Compare the monitoring performed to the plan the risk evaluation called for. A plan that promised a site visit that did not occur is an exception, even if reports were reviewed.
Step 5: Verify the subrecipient's audit
The pass-through entity must verify that subrecipients are audited as required by subpart F of the Uniform Guidance. The procedure is direct: for each subrecipient that expended federal awards at or above the audit threshold, inspect the evidence that a Single Audit was obtained, such as the FAC record or a copy of the report. If the subrecipient was below the threshold, inspect the support for that conclusion.
Step 6: Single Audit findings on the subrecipient
The pass-through entity must consider whether the results of the subrecipient's audits require adjustment of its own records and must resolve audit findings specific to the subaward. For findings that pertain only to the federal award it provided, it issues a management decision under 2 CFR 200.521.
The regulation allows reliance in one area. Where a subrecipient has a current Single Audit and is not debarred or suspended, the pass-through entity may rely on the subrecipient's cognizant or oversight agency for audit to follow up on cross-cutting findings, meaning those affecting multiple awards. The pass-through entity is not responsible for resolving cross-cutting findings in that case. The reliance is limited. Findings specific to the subaward, risk evaluation and monitoring remain the pass-through entity's duties.
Test by obtaining each subrecipient's audit report, identifying findings related to the subaward, and inspecting the management decision and the evidence of follow-up. For timing and content see the management decision guide.
Step 7: Enforcement
If a subrecipient does not comply, the pass-through entity may take the actions in 2 CFR 200.339, such as withholding payments, disallowing costs or terminating the subaward. When the audit file shows a subrecipient with significant unresolved noncompliance, ask what the pass-through entity did. The absence of any response is itself a monitoring weakness.
Evaluating exceptions
Classify exceptions by which part of the requirement failed: population, subaward information, risk evaluation, monitoring, audit verification, or follow-up. Consider whether the exception is isolated or systemic across the sample, and whether questioned costs result. The finding then follows the elements of 2 CFR 200.516: criteria, condition, cause, effect, questioned costs where applicable, prevalence, repeat status and recommendation. See writing findings.
Documentation checklist
- Population listing reconciled to the SEFA and disbursements.
- Subaward information tested element by element.
- Risk evaluation per subrecipient, with the factors considered.
- Monitoring evidence per sampled subaward.
- Audit verification for each subrecipient.
- Follow-up and management decision evidence on subrecipient findings.
- A conclusion for each step, tied to the Compliance Supplement objectives for the program.
CORAA prepares ready-to-review audit files for US CPA firms, including the subaward population reconciliation and sample selection schedules. The firm keeps the client, the review and the signature. See /us.
Sources
- Legal Information Institute, 2 CFR 200.332, Requirements for pass-through entities: https://www.law.cornell.edu/cfr/text/2/200.332
- Legal Information Institute, 2 CFR 200.339, Remedies for noncompliance: https://www.law.cornell.edu/cfr/text/2/200.339
- Legal Information Institute, 2 CFR 200.521, Management decisions: https://www.law.cornell.edu/cfr/text/2/200.521
- Legal Information Institute, 2 CFR 200.516, Audit findings: https://www.law.cornell.edu/cfr/text/2/200.516
Part of CORAA University · Government, single audit and nonprofits: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error