Building a Risk-Based Subrecipient Monitoring Program

Pass-through entities do not get credit for having a monitoring policy that looks good on paper. They get judged on whether monitoring identifies real risk, drives timely corrective action, and prevents questioned costs before they grow into repeat findings. A risk-based subrecipient monitoring program does exactly that: it directs scarce oversight time toward the subawards, cost categories, and control failures most likely to damage the Federal award.

This article focuses on practical program design for The Pass-Through (PTE) Desk. For a broader foundation, see Subrecipient Monitoring Under 2 CFR 200.332 and Pass-Through Entity Responsibilities: A Complete Checklist.

Define what “risk-based” actually means

Risk-based monitoring is not random file review, and it is not equal treatment for every subrecipient. It is a documented method for deciding where deeper review is necessary based on the likelihood and impact of noncompliance. The most effective models score both inherent risk and control risk, then translate those scores into required monitoring activities.

At a minimum, your model should distinguish between programmatic risk, financial risk, and governance risk. Financial risk is where many PTEs underinvest. If a subrecipient struggles with cost classification, indirect cost application, prior approval rules, or audit follow-up, that subaward should move up the monitoring queue quickly.

When building the model, anchor cost-related testing to 2 CFR 200.420, which states that selected items of cost are not a complete list and that allowability must still be analyzed under the broader cost principles. That prevents a common mistake: assuming an expense is safe simply because it is not expressly named in one section.

Build a formal risk universe before the first invoice

Start with objective scoring factors

A defensible program starts before the subaward is fully operational. Score each subrecipient using standardized factors such as newness to Federal funding, complexity of the scope, staffing turnover, decentralized operations, foreign activity, subrecipient type, and prior issues with documentation or timeliness.

Include organization-specific cost structure risks. 2 CFR 200.409 reminds readers that special considerations apply to states, local governments, Indian Tribes, and IHEs. That matters because the same monitoring template should not be applied blindly across all entity types.

Use indirect cost and allocation complexity as a major indicator

Indirect cost issues routinely signal broader control weakness. 2 CFR 200.412 states:

“There is no universal rule for classifying certain costs as direct or indirect costs. A cost may be direct for some specific service or function but indirect for the Federal award or other final cost objective. Therefore, each cost incurred for the same purpose in like circumstances must be treated consistently either as a direct or an indirect cost to avoid possible double-charging of Federal awards.”

If a subrecipient lacks written cost allocation support, does not understand when to use a negotiated rate or de minimis rate, or routinely shifts costs across objectives, elevate monitoring. Related reading: De Minimis Indirect Cost Rate: When and How to Use It and Cost Allocation Plans: Documentation That Holds Up.

Use award start-up to test controls, not just collect forms

Too many PTE onboarding checklists stop at SAM status, contacts, and signatures. A risk-based program uses start-up to test whether the subrecipient can operate the award correctly. Require written policies, approval matrices, draw procedures, and examples of how costs will be reviewed before they hit the general ledger.

Pay close attention to pre-award spending and start-date discipline. Under 2 CFR 200.458, pre-award costs are allowable only when they would otherwise be allowable and only with written approval of the Federal agency. If your subaward allows any pre-award activity, your monitoring file should contain that approval and clear charging instructions.

Another underused start-up control is employee notice language. 2 CFR 200.217 requires that the recipient and subrecipient inform employees in writing of employee whistleblower rights and protections. That is not a culture-only issue. It is a detection control for gross mismanagement, waste, abuse of authority, or violations tied to the award.

Target transaction testing to the cost categories that fail most often

Review for allowability and consistency

Transaction testing should be driven by risk, not by a fixed number of invoices per quarter. If a subrecipient has a history of thin support, expand testing into categories with frequent Uniform Guidance errors. Use 2 CFR 200.420 as the launch point, then test specific items.

Common cost traps worth sampling

• 2 CFR 200.421: advertising and public relations are only allowable in narrow circumstances, such as recruitment, procurement, disposal, or necessary program outreach.

• 2 CFR 200.432: conference costs may be allowable, but hosts must exercise discretion and judgment to keep costs appropriate and necessary.

• 2 CFR 200.437: employee health and welfare costs must follow established written policies and be equitably apportioned.

• 2 CFR 200.441: fines, penalties, damages, and similar costs are unallowable absent a narrow exception.

• 2 CFR 200.451: losses on other awards or contracts cannot be shifted into the Federal award.

• 2 CFR 200.454: some memberships are allowable, but social clubs and lobbying organizations are not.

• 2 CFR 200.434: donated services and property generally may not be charged as direct or indirect costs, even though they may sometimes support cost sharing.

If your team needs a sharper framework for analyzing these questions, pair monitoring workpapers with Mastering Allowable Cost Determination: 2 CFR 200.403 Explained.

Use audit history as predictive data, not comfort language

A clean tone from management is not evidence of low risk. Audit history is stronger evidence. Under 2 CFR 200.508, the auditee must arrange for the audit, prepare the required statements and SEFA, promptly follow up on findings, and provide the auditor access to records and personnel. Failure in any of those areas should influence your monitoring plan.

2 CFR 200.511 goes further by requiring the auditee to prepare a summary schedule of prior audit findings and a corrective action plan for current-year findings. A mature PTE does not just collect the report; it reviews whether corrective action was actually implemented, whether findings recurred, and whether the same control weakness could affect your subaward.

This is where many repeat findings are born: the PTE accepts a CAP narrative without retesting the failed process. For more on repeat-finding prevention, see Common Single Audit Findings and How to Prevent Them and Remediating Repeat Single Audit Findings: A Complete Guide.

Match monitoring techniques to risk tier

Low, medium, and high risk should not receive the same treatment

Low-risk subrecipients may justify desk reviews, standard invoice certification, and periodic document sampling. Medium-risk subrecipients usually warrant more frequent financial reviews, budget-to-actual analysis, and targeted source-document testing. High-risk subrecipients often require enhanced approvals, technical assistance, site visits, or temporary reimbursement restrictions.

When designing those tiers, map each risk factor to a mandatory response. For example, foreign currency activity may trigger exchange-rate review under 2 CFR 200.440. Sensitive facilities or products may justify added review of security spending under 2 CFR 200.457. IHE training awards may require extra testing of student support under 2 CFR 200.466.

Document the reason for every escalation

Auditors rarely criticize a PTE for exercising more oversight. They do criticize undocumented judgment. Your file should show the score, the reason for enhanced monitoring, the period covered, the documents reviewed, the exception noted, and the required follow-up date. If you need a broader readiness lens, review Audit Readiness Checklist: What Auditors Look For First.

Write subaward terms that make monitoring enforceable

A risk-based program fails when the subaward agreement does not give the PTE the rights needed to carry it out. High-risk awards should include precise reporting deadlines, source documentation rights, approval requirements for sensitive cost categories, access to policies, and clear remedies for late or unsupported costs.

This is especially important for indirect cost treatment. Where states, local governments, or Indian Tribes are involved, 2 CFR 200.416 explains the role of central service cost allocation plans and indirect cost rate proposals. If a subrecipient’s support is weak, the agreement should require rate documentation and consistent application.

Also consider specific approval language for advisory councils under 2 CFR 200.422 or unusual conference spending under 2 CFR 200.432. The more a cost category is misunderstood, the more your subaward should reduce ambiguity.

Escalate findings quickly and recover unallowable costs

A monitoring program is only credible if exceptions have consequences. When testing identifies unsupported or expressly unallowable costs, the PTE should issue a written determination, require repayment or offset, and track corrective action to closure.

Under 2 CFR 200.410, “Payments made for costs determined to be unallowable by either the awarding Federal agency, cognizant agency for indirect costs, or pass-through entity must be refunded with interest to the Federal Government.”