Major program determination step by step under 2 CFR 200.518

In this lesson you will

Compute the Type A threshold from total federal awards expended
Determine whether a Type A program is low-risk under 200.518(c)
Identify which Type B programs must be risk-assessed and how many must be high-risk
Apply the percentage of coverage rule, including the low-risk auditee criteria in 200.520

Step one: Type A and Type B

The auditor must use a risk-based approach (200.518(a)). Step one labels the larger programs Type A, using total federal awards expended:

Total federal awards expended	Type A threshold
$1,000,000 to $34 million	$1,000,000
Over $34 million to $100 million	Total times 0.03
Over $100 million to $1 billion	$3 million
Over $1 billion to $10 billion	Total times 0.003
Over $10 billion to $20 billion	$30 million
Over $20 billion	Total times 0.0015

Programs with expenditures exceeding the threshold are Type A; everything else is Type B. A cluster counts as one program. A large loan program (one exceeding four times the largest non-loan program) is always Type A and is removed before recomputing the threshold for the others (200.518(b)(3)). The major program determination calculator handles the table.

Step two: low-risk Type A programs

A Type A program is low-risk only if it was audited as a major program in at least one of the two most recent audit periods and, in the most recent period, had none of the following (200.518(c)):

a material weakness in internal control over the program;
a modified opinion on the program; or
known or likely questioned costs exceeding 5 percent of the program's expenditures.

Even when those tests are met, the auditor considers the 200.519(c) oversight criteria, audit follow-up results and changes in personnel or systems that indicate significantly increased risk. OMB can also approve an agency request that a program never be low-risk for a recipient.

Step three: high-risk Type B programs

Risk-assess only Type B programs that exceed 25 percent of the Type A threshold (200.518(d)(2)). Use professional judgment and the 200.519 criteria: weak controls, prior findings, programs not recently audited, oversight results, complexity, third-party contracting, eligibility, new programs or regulations, and first or last year of participation. Except for known material weaknesses or compliance problems, a single criterion would rarely make a Type B program high-risk. You are not required to identify more high-risk Type B programs than one-fourth of the number of low-risk Type A programs.

Step four: select major programs and test coverage

At minimum, audit as major (200.518(e)):

every Type A program not low-risk;
every high-risk Type B program; and
more programs as needed to meet the coverage rule.

Major programs must total at least 40 percent of total federal awards expended, or 20 percent if the auditee is low-risk (200.518(f)).

The low-risk auditee

200.520 makes an auditee low-risk when, for each of the preceding two audit periods: single audits were performed annually and submitted on time; the financial statement opinion and in-relation-to SEFA opinion were unmodified; there were no material weaknesses under GAGAS; there was no going concern substantial doubt reported; and no Type A program had a material weakness over compliance, a modified compliance opinion or questioned costs over 5 percent of the program. A late filing in either year disqualifies the auditee, and biennial audits never qualify.

Documentation

The risk analysis goes in the audit documentation (200.518(g)). When performed and documented under Subpart F, the auditor's judgment is presumed correct, and challenges are limited to clearly improper use of the requirements (200.518(h)). That presumption only protects a documented analysis. Use the major program determination worksheet.

Common file mistakes

Clusters split into separate programs.
Type A low-risk conclusions with no check of prior-year findings or questioned cost percentages.
Type B programs under the 25 percent floor risk-assessed while larger ones are skipped.
Coverage computed on the wrong denominator or the low-risk auditee rate used after a late FAC submission.

Worked example

Northgate County: picking the major programs

Northgate County expends $12,400,000 of federal awards in fiscal 2026. Total is under $34 million, so the Type A threshold is $1,000,000.

Type A (over $1,000,000): A $3,000,000; B $2,500,000; C $1,800,000; D $1,400,000; E $1,200,000. A, C, D and E were audited as major last year with no material weakness, no modified opinion and questioned costs under 5 percent, so they are low-risk. B is new and was not audited as major in either of the last two periods, so it is not low-risk.

Type B: F $900,000; G $700,000; H $500,000; I $300,000; J $100,000. Risk-assessment floor = 25 percent x $1,000,000 = $250,000, so F, G, H and I are assessed and J is not. With four low-risk Type A programs, the cap is one-fourth x 4 = 1 high-risk Type B program. F had a repeat eligibility finding and is high-risk.

Initial major programs: B + F = $3,400,000, which is 27.4 percent of $12,400,000.

Northgate filed one year's reporting package late, so it is not a low-risk auditee and needs 40 percent: 0.40 x $12,400,000 = $4,960,000. Adding C ($1,800,000) brings coverage to $5,200,000, or 41.9 percent. Major programs: B, F and C.

Self-check

Answer each question before you open the answer.

Total federal awards expended are $60 million. What is the Type A threshold?
Show answer
$1,800,000. Totals over $34 million up to $100 million use total expenditures times 0.03, and $60,000,000 x 0.03 = $1,800,000.
A Type A program was audited as major two years ago with a clean result, but not last year. Can it be low-risk?
Show answer
Yes, if it meets the conditions. 200.518(c) requires it to have been audited as major in at least one of the two most recent audit periods, and the clean-result tests apply to the most recent audit period.
The Type A threshold is $1,000,000. Must the auditor risk-assess a $200,000 Type B program?
Show answer
No. Only Type B programs exceeding 25 percent of the Type A threshold, here $250,000, require a risk assessment under 200.518(d)(2).
An auditee filed its reporting package 45 days late two years ago. Can the auditor use the 20 percent coverage rule this year?
Show answer
No. 200.520(a) requires timely submission for each of the preceding two audit periods, so the auditee is not low-risk and the 40 percent rule applies.

Sources

Back to the syllabus

Standards are paraphrased from the primary sources listed above; read the source before relying on a requirement. This lesson is training material, not professional advice. Report an error