Section 200.303 of the Uniform Guidance is the regulation behind the internal control findings in a single audit. It puts the obligation on the recipient or subrecipient, not the auditor: establish, document and maintain effective internal control over the Federal award. When the auditor reports a significant deficiency or material weakness in internal control over compliance for a major program, this is the standard the control is measured against.
This page paraphrases the regulation as it reads on eCFR. Read 2 CFR 200.303 and Subpart F for the full text.
What does 200.303 require?
The recipient and subrecipient must:
| Paragraph | Requirement |
|---|---|
| (a) | Establish, document and maintain effective internal control over the Federal award that provides reasonable assurance that the Federal award is managed in compliance with Federal statutes, regulations and the terms and conditions of the award. The controls should align with either the Comptroller General's Standards for Internal Control in the Federal Government (the Green Book) or the COSO Internal Control-Integrated Framework |
| (b) | Comply with the U.S. Constitution, Federal statutes, regulations and the terms and conditions of the award |
| (c) | Evaluate and monitor compliance with those requirements |
| (d) | Take prompt action when instances of noncompliance are identified |
| (e) | Take reasonable cybersecurity and other measures to safeguard information, including protected personally identifiable information and other information the Federal agency or pass-through entity designates as sensitive or the recipient considers sensitive, consistent with applicable Federal, State, local and Tribal privacy and confidentiality laws |
Two features are worth noting. First, the control standard is reasonable assurance, not absolute. Second, the framework choice is open: a recipient may align with the Green Book or COSO. Most nonprofits and local entities use COSO because their financial statement auditors already do.
What is the link to the single audit?
The auditor's opinion on compliance for each major program is accompanied by a report on internal control over compliance. Weaknesses in internal control over a program are a risk factor in picking major programs, and a material weakness in the most recent period removes a Type A program's low-risk status and the auditee's low-risk auditee status. See major program determination.
The questioned cost definition also separates control from compliance: there is no questioned cost solely because of deficiencies in internal control. A control finding can stand alone, with no dollars attached.
How does COSO map to a federal award?
An illustrative mapping a recipient could document for one award. The components are COSO's five. The examples are practice illustrations, not requirements of the regulation.
| COSO component | Example of what the recipient documents for the award |
|---|---|
| Control environment | Written policy assigning grant compliance to named staff; code of conduct; board or committee oversight of Federal funds |
| Risk assessment | A compliance matrix of award terms, such as allowable activities, eligibility, reporting dates and match, with owners |
| Control activities | Prior approval of purchases over a set dollar amount, timesheet approval for charged salaries, a monthly budget-to-actual review by the program officer and finance |
| Information and communication | Award documents on file, internal distribution of award changes, reporting calendar |
| Monitoring | Quarterly compliance self-review, subrecipient monitoring, tracking of audit findings to closure |
A compliance matrix is a small document with a large effect. It lists each requirement in the notice of award and the compliance supplement's program section, the control that addresses it, who performs it and how it is evidenced.
An illustration
Illustrative only. A nonprofit's single audit finds that salary charges to a major program were based on budgeted percentages, not timesheets. The salary charged is $210,000. The allowable-costs test shows that supporting records for $60,000 of it do not exist. The $60,000 is a questioned cost under the documentation limb of the definition. The control finding is separate: the nonprofit has no control that checks charged salaries against records of actual effort. The auditor reports the control deficiency, and, depending on severity and likelihood, evaluates it as a significant deficiency or a material weakness. The questioned cost and the control finding are two findings from one fact pattern. See allowable costs.
What do auditors ask for?
Practice observations built from the text, not requirements of the regulation:
- The documentation. Written policies and procedures for the Federal award, not only verbal practice. Paragraph (a) says establish, document and maintain.
- Framework alignment. Which framework, Green Book or COSO, and how the controls map.
- Evidence of monitoring. Dated reviews and follow-up under (c) and (d).
- Prompt action. What happened when noncompliance was identified, and how fast.
- Cybersecurity. Paragraph (e) is a compliance requirement. Ask what measures protect personally identifiable information in program files, and who has access. A small entity can meet it with access controls, encryption of devices and a vendor review, scaled to the data.
- Design and operation. Walk through one transaction for each requirement, then test operation on a sample. See walkthroughs and tests of controls.
Frequently asked questions
Which framework does 200.303 require?
It says the controls should align with the Green Book or the COSO Internal Control-Integrated Framework. The recipient chooses.
Does 200.303 require a written internal control policy?
It requires recipients to establish, document and maintain effective internal control over the Federal award. The documentation obligation is in the text of paragraph (a).
Is cybersecurity part of 200.303?
Yes. Paragraph (e) requires reasonable cybersecurity and other measures to safeguard information, including protected personally identifiable information and information the agency or pass-through entity designates as sensitive.
Can there be a control finding without a questioned cost?
Yes. The definition of questioned cost says there is none solely because of deficiencies in internal control.
Sources
- eCFR, 2 CFR 200.303 and the questioned cost definition in 200.1 (current text, retrieved November 2026): ecfr.gov
- U.S. Government Accountability Office, Standards for Internal Control in the Federal Government (GAO-14-704G): gao.gov
- COSO, Internal Control-Integrated Framework (2013)
Related
Part of CORAA University · Government, single audit and nonprofits: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error