A nonprofit or local government that passes Federal money to another organization carries the Federal compliance obligations for that money. Section 200.332 of the Uniform Guidance lists what a pass-through entity must do: check who it is funding, put the required terms in the subaward, evaluate risk, monitor, and follow up on audit findings. Section 200.331 comes first and decides whether a payee is a subrecipient at all, because a contractor does not trigger these duties.
For auditors this is a standing compliance requirement in single audits of pass-through entities, and an area where the lack of documentation is easy to see. This page paraphrases the regulation as it reads on eCFR. Read 2 CFR 200.331 and 200.332 for the full text.
Subrecipient or contractor? Section 200.331
The pass-through entity is responsible for making case-by-case determinations. The text says the substance of the relationship is more important than the form of the agreement, that no single factor or combination is necessarily determinative, and that an entity may be a recipient, a subrecipient and a contractor at the same time.
| Characteristics that support a subrecipient | Characteristics that support a contractor |
|---|---|
| Determines who is eligible to receive what Federal assistance | Provides goods and services within normal business operations |
| Performance is measured against whether Federal program objectives were met | Provides similar goods or services to many different purchasers |
| Has responsibility for programmatic decision-making | Normally operates in a competitive environment |
| Is responsible for adherence to Federal program requirements specified in the award | Provides goods or services ancillary to implementing the Federal program |
| Implements a program for a public purpose in the authorizing statute, rather than providing goods or services for the pass-through entity's benefit | Is not subject to the Federal program's compliance requirements because of the agreement |
The distinction matters in the audit. Payments to a contractor are not Federal awards expended under 200.501(g), and the pass-through entity's compliance responsibility for contractors is generally to ensure procurement, receipt and payment comply. For subrecipients, the full set of 200.332 duties applies, and the subaward counts as a Federal award expended by the pass-through entity when funds are disbursed.
What must the pass-through entity do? Section 200.332
The paragraph structure of the section is a workable checklist:
- (a) Verify exclusion status. Confirm the subrecipient is not excluded or disqualified under 2 CFR 180.300, which includes checking SAM.gov for suspension, debarment or exclusion.
- (b) Issue a complete subaward. Identify every subaward as a subaward and include the required information: subrecipient name and unique entity identifier, Federal Award Identification Number, award date, period of performance, budget period, amount obligated in the subaward and in total to the subrecipient, FFATA project description, awarding agency and contact, Assistance Listing title and number, whether the award is for research and development, and the indirect cost rate. Provide the best available information when some is not yet known and supply it when obtained. Also include all requirements of the subaward, any additional requirements the pass-through entity imposes, the indirect cost rate treatment, a requirement that the subrecipient permit access to its records and financial statements, and closeout terms.
- (c) Evaluate risk. Evaluate each subrecipient's fraud risk and risk of noncompliance to set the monitoring approach. The factors listed are the subrecipient's prior experience with the same or similar subawards, results of previous audits including whether it receives a single audit and whether the same or similar subawards were audited as major programs, new personnel or substantially changed systems, and the extent and results of Federal agency monitoring.
- (d) Consider specific conditions under 200.208 and notify the Federal agency of any imposed.
- (e) Monitor. Review financial and performance reports, ensure corrective action on significant developments that negatively affect the subaward (including single audit findings, site visits and written notices of adverse conditions), issue a management decision for audit findings that pertain only to the Federal award the pass-through entity provided, and resolve audit findings specifically related to the subaward.
- (f) Use monitoring tools suited to the risk, such as training and technical assistance, site visits and agreed-upon procedures engagements under 200.425.
- (g) Verify the subrecipient was audited as required by Subpart F.
- (h) Adjust records if audit results, site visits or monitoring require it.
- (i) Consider enforcement action under 200.339 against noncompliant subrecipients.
On indirect costs, the pass-through entity must not require the de minimis rate if the subrecipient has an approved rate negotiated with the Federal Government. Otherwise it may use a negotiated rate with the subrecipient or the de minimis rate. See indirect costs.
Cross-cutting findings get special treatment: the pass-through entity is not responsible for resolving audit findings that apply to the subaward and other Federal awards or subawards, and may rely on the subrecipient's cognizant or oversight agency for audit for those, provided the subrecipient has a current single audit report and has not been excluded. That reliance does not remove the duty to issue conforming subawards, manage risk through ongoing monitoring, and track findings specifically related to the subaward.
A worked illustration
Illustrative only. A county nonprofit passes $240,000 of a Federal grant to three organizations in the same year.
| Payee | Facts | Classification |
|---|---|---|
| Community clinic | Decides which residents qualify, delivers the service, reports outcome measures against grant objectives | Subrecipient |
| IT vendor | Sells hosting to many customers at standard pricing, competitive bid | Contractor |
| Food pantry | Distributes aid under its own eligibility screen and reports client counts | Subrecipient |
Suppose the clinic received $150,000 and the pantry $60,000, with $30,000 going to the vendor. The two subrecipients total $150,000 + $60,000 = $210,000, and the vendor is $30,000, which agrees to $240,000. For each subrecipient the nonprofit needs the SAM.gov check, a compliant subaward, a risk evaluation, monitoring evidence and a check on whether the subrecipient received a single audit. For the vendor it needs procurement records.
What do auditors test?
Practice observations built from the text, not requirements of the regulation:
- Classification memo per payee. The 200.331 determination, signed and dated, with the facts.
- Subaward terms. Compare each subaward to the 200.332(b) data elements. Missing FAIN, Assistance Listing number or indirect rate information are common gaps to look for.
- Exclusion check dated before award. A SAM.gov screenshot or record with a date.
- Risk evaluation tied to monitoring. Higher-risk subrecipients should show more monitoring, not the same routine.
- Audit follow-up. Evidence that the pass-through entity checked the subrecipient's audit status, reviewed findings and issued management decisions.
- Single audit status. Entities under the audit threshold need alternative monitoring. See the 200.501 threshold.
Frequently asked questions
Does a contractor trigger subrecipient monitoring?
No. A contract obtains goods and services for the recipient's use and creates a procurement relationship. Subrecipient monitoring applies to subawards that carry out part of the Federal award.
Who decides whether a payee is a subrecipient or a contractor?
The pass-through entity makes the determination case by case, using judgment and weighing substance over the form of the agreement.
Must the pass-through entity verify that the subrecipient had a single audit?
Yes. Paragraph (g) requires verifying that a subrecipient is audited as required by Subpart F.
Can the pass-through entity rely on the subrecipient's own cognizant agency for audit follow-up?
For cross-cutting audit findings, yes, if the subrecipient has a current single audit report and has not been debarred or suspended. The pass-through entity still resolves findings specific to its subaward.
Sources
- eCFR, 2 CFR 200.331, 200.332 and the definitions of subaward, subrecipient and pass-through entity in 200.1 (current text, retrieved November 2026): ecfr.gov
- 2 CFR 180.300 (verification of exclusion)
Related
Part of CORAA University · Government, single audit and nonprofits: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error