Subrecipient Monitoring: The Five Gaps Auditors Find First

By Sam Mombou, PhD, MBA, CRA · 4 minute read

When an institution passes federal funds to a subrecipient, it takes on the sponsor's obligation to ensure those funds are used properly. The Uniform Guidance at 2 CFR 200.332 lays out what that requires: a risk assessment, award terms that flow down the federal requirements, monitoring proportional to the risk, review of the subrecipient's audit results, and follow-up on deficiencies. The requirements are not complicated. The gaps appear in execution, and they appear in a consistent order.

Gap one: the risk assessment is a form, not a judgment

Many institutions complete a risk assessment checklist at the time of subaward issuance and never look at it again. Auditors will ask how the assessment influenced the monitoring plan. If every subrecipient receives the same monitoring regardless of its risk score, the assessment served no purpose. A defensible process documents the risk rating, states what additional monitoring the rating triggers, and shows that the additional monitoring actually occurred.

Gap two: required data elements are missing from the subaward

The guidance specifies the information every subaward must contain, including the federal award identification number, the assistance listing number, the indirect cost rate, and the pass-through entity's contact information. Institutions using older templates or one-off agreements frequently omit one or more. This is the easiest finding for an auditor to document because it requires only reading the agreement.

Gap three: invoices are paid without review

Subrecipient invoices should be reviewed for consistency with the approved budget, the period of performance, and the technical progress reported. In practice, many institutions pay invoices on receipt if the amount is within budget. Auditors will select invoices and ask what review was performed. A short review record on each invoice, signed by someone with knowledge of the project, resolves this gap.

Gap four: single audit results are collected but not acted on

Institutions generally know to obtain subrecipient audit reports, often through the Federal Audit Clearinghouse. The gap is what happens next. If a subrecipient's audit reports findings related to federal awards, the pass-through entity must determine whether those findings affect its subaward and issue a management decision where required. Auditors will ask for the management decision letters. Many institutions cannot produce them.

Gap five: closeout happens on paper only

At the end of the subaward, the pass-through entity should confirm that final invoices reconcile to the budget, that technical deliverables were received, that any equipment or property is accounted for, and that the subrecipient has met its own closeout obligations. Institutions under deadline pressure often close the subaward in the financial system without confirming these items. The problem surfaces later, when a sponsor questions a cost that the institution can no longer support.

Closing the gaps

Each of these gaps can be closed with a documented procedure and a modest amount of staff time. The 2024 revision to the Uniform Guidance raised the single audit threshold to $1 million, which will move some subrecipients outside the audit population and increase the importance of the pass-through entity's own monitoring. Institutions should take this as a prompt to review their program rather than wait for the next audit cycle.

RACCS designs and documents subrecipient monitoring programs as part of the SPA Performance Lift™ engagement. Request a scoping call to learn more.