Recipients and subrecipients of federal awards must buy goods and services under rules in the Uniform Guidance at 2 CFR part 200. Typical exceptions are no documented procedures, no record of why a method was chosen, a conflict nobody checked, and a sole-source award with no basis. This post summarizes 2 CFR 200.318 and 200.320 as they appear in the eCFR, in the version effective October 1, 2024, and turns them into a control matrix and test program.
2 CFR 200.318: general procurement standards
- Documented procedures (a). Recipients and subrecipients must maintain and use documented procedures for procurement transactions, consistent with state, local and tribal law and with the standards in 200.317 through 200.327.
- Contractor oversight (b). They must maintain oversight to ensure contractors perform in accordance with the terms, conditions and specifications of their contracts.
- Conflicts of interest (c)(1). They must keep written standards of conduct covering conflicts of interest. A person with a real or apparent conflict may not take part in contracts supported by the federal award. Staff may not solicit or accept gifts or other things of value from contractors, subject to minor exceptions the entity may set, and the standards must include disciplinary actions.
- Procurement records (i). Records must be sufficient to detail the history of each procurement, including the rationale for the method, contract type, selection or rejection of the contractor and the basis for the price.
2 CFR 200.320: methods
The rule has three categories.
- Informal procurement at or below the simplified acquisition threshold. Micro-purchases may be made without competitive quotes if the entity documents that the price is reasonable; purchases should be distributed equitably among qualified suppliers where practical. Simplified acquisitions above the micro-purchase level require price or rate quotes from an adequate number of qualified sources.
- Formal procurement above the entity's simplified acquisition threshold. Sealed bids (firm fixed-price award to the lowest responsive, responsible bidder, preferred for construction, with public advertisement and opening for local governments) or proposals (public notice, stated evaluation factors, written evaluation procedures, award to the most advantageous proposal). Qualifications-based selection without price as a factor is limited to architectural and engineering professional services.
- Noncompetitive procurement, allowed only when the purchase is at or below the micro-purchase threshold, only a single source can fulfil it, a public exigency or emergency does not allow time for public notice, the recipient requests it in writing and the federal agency or pass-through entity approves in writing, or competition is found inadequate after soliciting several sources.
The dollar amounts come from the Federal Acquisition Regulation, which 2 CFR 200.1 and 200.320 point to. Under 48 CFR 2.101 as adjusted effective October 1, 2025, the FAR micro-purchase threshold is $15,000 and the simplified acquisition threshold is $350,000. Older materials cite $10,000 and $250,000, which are no longer the base figures. The rule also allows an entity to self-certify a micro-purchase threshold up to $50,000 annually with justification and documentation, on grounds that include low-risk auditee status, an annual risk assessment or, for public institutions, consistency with state law. Thresholds above $50,000 require approval from the cognizant agency for indirect costs. An entity may set its simplified acquisition threshold lower than, but not above, the Federal Acquisition Regulation threshold.
Control matrix
| ID | Risk | Control | Test step |
|---|---|---|---|
| PR-01 | No documented procedures | Written procurement policy covering 200.317 to 200.327 and approved by management | Inspect policy and approval date; compare to rule elements |
| PR-02 | Wrong method for the amount | Procurement requisition identifies the dollar value and method required; procurement officer approves the method | Sample awards; compare method to the entity's thresholds |
| PR-03 | Conflict of interest | Annual conflict disclosure by staff and board; screening of evaluation team; gifts log | Obtain disclosures; compare vendor and staff data for matches |
| PR-04 | Noncompetitive award without a basis | Written justification citing the allowed condition; prior approval where required | Test each noncompetitive award |
| PR-05 | Price not reasonable | Cost or price analysis documented; micro-purchase reasonableness noted | Inspect analysis |
| PR-06 | Incomplete procurement file | File checklist: need, method, solicitation, evaluation, selection, price basis, contract | Inspect files against checklist |
| PR-07 | Splitting purchases to avoid thresholds | Review of multiple purchases to one vendor in a period | Analytic on vendor spend by month |
| PR-08 | Contract oversight weak | Contract manager assigned; deliverable acceptance documented | Sample contracts; test acceptance evidence |
| PR-09 | Suspended or debarred vendors | Check against the federal exclusion list before award | Compare vendor list to exclusion records |
| PR-10 | Charging unallowable procurement costs to awards | Cost review before charging to award | Sample charges |
Worked example
A nonprofit with $4 million of federal expenditures buys software implementation services for $180,000 using the executive director's preferred vendor. The file contains the contract and invoices but no solicitation and no price analysis.
Analysis under 200.318(i) and 200.320: the file lacks the rationale for the method and for the price. The nonprofit's own procedures set the simplified acquisition threshold at $100,000, so the purchase required a formal method. The only exception, noncompetitive procurement, needs a stated basis (single source, exigency, written approval or inadequate competition). None is documented. Finding: condition, noncompetitive award of $180,000 with no documented basis; criteria, 200.320(b) and (c) and the entity's procedures; cause, no procurement officer review above $25,000; effect, questioned costs of up to $180,000 for the federal program. Under Standard 14.2 Analyses and Potential Engagement Findings, the difference between criteria and condition is a potential finding that must be noted and further evaluated. See /us/blog/schedule-of-findings-and-questioned-costs-writing-findings for how auditors report it.
Where it fits in the audit
Procurement compliance is part of single audit testing of major programs. See /us/blog/single-audit-uniform-guidance-walkthrough and /us/standards/2-cfr-200-303-internal-controls-federal-awards.
Mistakes to avoid
- Adopting a micro-purchase threshold above the base level without the required self-certification documentation or approval.
- Treating a sole source as a convenience instead of a documented exception.
- Keeping procurement files in several locations.
- Skipping the conflict check for board members who vote on awards.
CORAA prepares ready-to-review audit files for US CPA firms from client books; the firm keeps the client, the review and the signature. See /us.
Sources
- 2 CFR 200.318, General procurement standards: https://www.ecfr.gov/current/title-2/part-200/section-200.318
- 2 CFR 200.320, Procurement methods: https://www.ecfr.gov/current/title-2/part-200/section-200.320
- 48 CFR 2.101, Definitions (micro-purchase threshold, simplified acquisition threshold): https://www.ecfr.gov/current/title-48/section-2.101
- The IIA, Global Internal Audit Standards (2024), Standard 14.2 Analyses and Potential Engagement Findings: https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/
Part of CORAA University · Internal controls and SOX: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error