Remediating Repeat Single Audit Findings

Why repeat findings are uniquely serious

Repeat Single Audit findings are not just old problems showing up again. They signal that corrective action was incomplete, poorly designed, undocumented, or never embedded into routine operations. From an audit-readiness perspective, a repeat finding tells auditors and pass-through entities that management identified a control issue once, but did not fully eliminate the root cause. That often increases scrutiny over internal control, allowability, reporting reliability, and subrecipient oversight.

When repeat findings involve costs, the compliance risk quickly expands beyond control weakness into questioned costs, repayment exposure, and credibility issues in future monitoring. The Uniform Guidance is direct that allowable costs must “be adequately documented” under 2 CFR 200.403, and that costs must be necessary, reasonable, allocable, consistently treated, and properly supported. If the same documentation or allocation flaw appears across multiple audit periods, the finding is rarely about one transaction. It is about system design.

If you need a baseline map of recurring audit issues, start with Common Single Audit Findings and How to Prevent Them. This article focuses on the next step: how to make sure a finding does not come back.

Start with the exact anatomy of the repeat finding

Separate condition, cause, effect, and repeat trigger

An effective remediation plan begins by restating the finding in four parts: the condition observed, the root cause, the compliance requirement affected, and the reason the issue repeated. Many organizations skip the last element. They fix the visible error but never determine why the prior corrective action plan failed.

For example, a repeat payroll allocation finding may appear to be a time-distribution problem. But the deeper issue may be that the organization lacks a documented cost allocation methodology, supervisors do not review after-the-fact support, and accounting applies charges inconsistently across awards. That touches 2 CFR 200.405 on allocable costs, 2 CFR 200.412 on consistent cost classification, and 2 CFR 200.413 on direct costs.

Map the finding to the authoritative requirement

Every remediation workplan should cite the exact regulatory requirement that was not met. If the issue concerns unsupported expenditures, anchor the plan to 2 CFR 200.403, which requires costs to “be adequately documented.” If the issue concerns direct charging of administrative salaries, map it to 2 CFR 200.413. If the finding involves unallowable publicity costs or similar charges, the analysis should extend to 2 CFR 200.421.

This discipline matters because vague corrective actions such as “staff will be retrained” rarely cure the actual compliance gap.

Root cause analysis: the step most entities underinvest in

Repeat findings usually arise from one of five root causes: no written procedure, a written procedure that conflicts with actual practice, lack of review evidence, system limitations, or unclear ownership. Training alone is seldom enough. Under 2 CFR 200.404, reasonableness includes whether decision-makers “acted with prudence” and whether the cost “represents a deviation from the recipient's or subrecipient's established written policies and procedures.” If the written policy is missing or routinely ignored, repeated exceptions are predictable.

I recommend documenting root cause in a short matrix: what failed, why it failed, what control should have stopped it, and what evidence will prove the new control worked. That last column is where many remediation plans become durable. Auditors test evidence, not intentions.

For cost allocation issues, pair this article with Cost Allocation Plans: Documentation That Holds Up. For institutions dealing with compensation support, see Effort Certification Under Uniform Guidance for IHEs.

Design corrective actions that change the process, not just the file

Build controls at the transaction level

If a finding involved unsupported or misclassified charges, the remediation should redesign the transaction workflow. Add pre-payment checklists, approval gates, account coding validation, and monthly exception reporting. The standard in 2 CFR 200.403 requires more than general reasonableness; costs must conform to award limitations, be consistently treated, and not be used to support another federally financed program.

Distinguish direct, indirect, and shared costs clearly

Many repeat findings are really cost-structure findings. Under 2 CFR 200.412, “each cost incurred for the same purpose in like circumstances must be treated consistently either as a direct or an indirect cost.” When that consistency is absent, findings reappear across payroll, supplies, occupancy, and admin salaries.

If your organization uses an indirect cost rate or is considering the de minimis approach, see De Minimis Indirect Cost Rate: When and How to Use It and Mastering F&A Rates in Higher Education: A 2 CFR 200 Guide.

Address repayment, credits, and prior-period corrections early

When a repeat finding includes unallowable costs, remediation is not complete until the financial correction path is defined. Under 2 CFR 200.410, payments made for costs determined to be unallowable “must be refunded with interest to the Federal Government.” Under 2 CFR 200.406, applicable credits such as rebates, refunds, recoveries, and overpayment adjustments must reduce the Federal award as appropriate.

For indirect cost findings, 2 CFR 200.411 requires rate adjustments or refunds when negotiated rates included unallowable or unallocable costs. That means remediation may affect not just current-period transactions but prior rate calculations, future proposals, and cash settlement with the cognizant agency.

A practical rule: if the finding affects money, create a parallel finance workstream and a controls workstream. One fixes the dollars; the other fixes the cause.

Use prior approval strategically, but do not misuse it

Some repeat findings stem from a mistaken belief that silence from the awarding agency equals approval. It does not. Under 2 CFR 200.407, prior written approval may help avoid later disputes when reasonableness or allocability is difficult to determine, but “the absence of prior written approval on any element of cost will not, in itself, affect the reasonableness or allocability of that cost unless prior approval is specifically required.”

The remediation takeaway is to build a decision tree identifying which cost categories require explicit advance approval under the award terms or cited sections. Repeat findings often occur because staff treat unusual costs as routine. If the charge is novel, sensitive, or only arguably programmatic, require escalation before obligation.

Do not ignore culture and reporting channels

Some repeat findings persist because staff are reluctant to challenge established charging practices or management overrides. That is where whistleblower protection and reporting culture matter. Under 2 CFR 200.217, an employee of a recipient or subrecipient must not be retaliated against for disclosing information they reasonably believe evidences gross mismanagement, gross waste, abuse of authority, danger to public health or safety, or violation of law, rule, or regulation related to a Federal contract or grant. The regulation also requires written notice to employees of whistleblower rights and protections.

That provision is not just an HR footnote. It can be part of remediation for repeated allowability, procurement, or subrecipient issues. When staff know how to elevate concerns safely, organizations detect repeat-risk behavior before the next audit cycle.

Special problem areas that commonly generate repeats

Allowability and documentation

The most common repeat pattern is simple: costs are charged first and justified later. That is backward under 2 CFR 200.403 and 2 CFR 200.404. The fix is a contemporaneous file standard with required support by cost type.

Subrecipient oversight

If findings recur in subaward monitoring, your corrective action likely focused on collecting reports rather than risk-based oversight. Build documented review steps, issue tracking, and escalation rules. For a detailed companion piece, see Subrecipient Monitoring Under 2 CFR 200.332 and Pass-Through Entity Responsibilities: A Complete Checklist.

Procurement and sole source exceptions

Repeated procurement findings frequently come from after-the-fact justification. If your issue involves noncompetitive procurement, align remediation with documentation triggers and approval sequencing. See Sole-Source Procurement: When Justification Is Required and 5 Procurement Methods Under 2 CFR 200: A Practical Guide.

How to document a corrective action plan auditors can trust

A credible CAP should identify the finding number, regulatory criteria, root cause, corrective steps, owner, completion date, testing method, and retained evidence. Also identify how management will verify operating effectiveness over time. That last element is what turns a one-time response into sustainable remediation.

Where financial reporting is implicated, remember the certification standard in 2 CFR 200.415. The required certification language underscores that reports must be true, complete, and accurate, and that false or omitted material facts carry serious consequences. Repeat findings tied to reporting quality should therefore be remediated with certification support files, preparer-reviewer signoff, and documented reconciliation controls.

For a broader readiness framework, review Audit Readiness Checklist: What Auditors Look For First.

Testing whether remediation actually worked

The best time to test corrective action is before the auditors return. Pull a sample of post-remediation transactions and ask whether the new control would have prevented the original finding. If not, the CAP is incomplete. Effective testing checks design and operation: was the policy updated, was the control performed, was evidence retained, and were exceptions escalated?