Subrecipient Monitoring and Pass-Through Funding

A pass-through entity that subawards federal funds must classify each agreement as a subaward or a procurement contract, include required terms and data in every subaward, assess each subrecipient’s risk, monitor performance and finances, ensure required audits occur, and resolve subaward findings.

Current figures — verified 2026-08-11

Item	Value	Source
Single Audit trigger for a subrecipient	$1,000,000 or more in federal awards expended in a fiscal year	2 CFR 200.501(a)
Management decision deadline on subaward findings	Within six months of the Federal Audit Clearinghouse’s acceptance of the audit report	2 CFR 200.521(d)
Subrecipient final report and liquidation deadline	90 calendar days after the subaward period of performance ends	2 CFR 200.344(b)–(c)
First-tier subaward transparency reporting trigger	Each subaward equal to or above $30,000 in federal funds	2 CFR part 170, Appendix A
Subaward amount included in modified total direct costs	Up to the first $50,000 of each subaward	2 CFR 200.1
De minimis indirect cost rate available to a subrecipient	Up to 15 percent of modified total direct costs	2 CFR 200.414(f)

These figures change. Verify against the linked source before relying on them. Report an outdated figure

Key takeaways

• The pass-through entity stays accountable for the subrecipient’s spending.
• Substance decides subrecipient versus contractor, not the agreement’s title.
• Fourteen data elements must appear in every subaward.
• Risk assessment sets monitoring intensity; it is not optional.
• Blanket caps on a subrecipient’s indirect rate are not permitted.

What changes when you pass federal grant funds to another organization?

Passing federal funds to another organization makes you a pass-through entity and adds a full compliance function on top of running your own program, on top of the reporting and approval duties covered across managing the award. A pass-through entity is “a recipient or subrecipient that provides a subaward to a subrecipient (including lower tier subrecipients) to carry out part of a Federal program,” and the authority of the pass-through entity “flows through the subaward agreement” (2 CFR 200.1).

The structural fact that makes monitoring self-protective rather than courteous is the absence of privity below the prime. The federal agency “does not have a direct legal relationship with subrecipients or contractors of any tier; however, the Federal agency is responsible for monitoring the pass-through entity’s oversight of first-tier subrecipients” (2 CFR 200.331). When a subrecipient charges an unallowable cost, the agency does not pursue the subrecipient. It looks at the pass-through entity’s records and disallows the cost there.

Nine duties attach to a pass-through entity under 2 CFR 200.332: verify the subrecipient is not excluded, issue a subaward containing required information and terms, assess risk, consider specific conditions, monitor, apply risk-calibrated tools, verify required audits occur, adjust its own records where monitoring results require it, and consider enforcement action. Together those nine duties define the pass-through function.

Exclusion checking comes first and takes minutes. Before entering a covered transaction with an entity at the next lower tier, the pass-through entity must verify the entity is not excluded or disqualified, by checking SAM.gov exclusions, collecting a certification, or adding a clause to the agreement (2 CFR 180.300).

How do you tell a subrecipient from a contractor?

A subrecipient carries out part of the federal program and makes programmatic decisions; a contractor sells goods or services it provides in its normal business to many purchasers. The determination is made case by case by the pass-through entity, and the label on the paperwork does not control it.

The framing rule at 2 CFR 200.331 is explicit about both the judgment and the standard: “No single factor or any combination of factors is necessarily determinative. The pass-through entity must use judgment in classifying each agreement as a subaward or a procurement contract. In making this determination, the substance of the relationship is more important than the form of the agreement.” The definition of subaward reinforces the point — a subaward “may be provided through any form of legal agreement,” including one the pass-through entity considers a contract (2 CFR 200.1).

The table below sets the regulatory indicators for each classification side by side, using the characteristics listed at 2 CFR 200.331(a) and (b).

Entity	Eligibility decisions	Programmatic decision-making	What the entity provides	Program compliance duty
Subrecipient	Determines who is eligible for federal assistance	Holds responsibility for programmatic decisions	Carries out part of the federal program for a public purpose in statute	Responsible for adherence to federal program requirements
Contractor	No role in eligibility	No programmatic decision authority	Goods or services within normal business operations, provided to many purchasers and ancillary to the program	Not subject to program compliance requirements as a result of the agreement

The determination is not paperwork. Federal awards expended as a recipient or subrecipient are subject to audit; “payments received for goods or services provided as a contractor under a Federal award are not subject to audit under this part” (2 CFR 200.501(g)). Classification therefore decides whether an organization owes a Single Audit, whether federal requirements flow down, and whether the pass-through entity applies procurement standards or monitoring standards. It also moves money: only the first portion of each subaward shown in the figures above enters the modified total direct cost base, which caps indirect recovery per subaward in a way that a contract does not, as explained under indirect cost rates and the de minimis option.

An entity can be both. A single organization may concurrently receive federal awards as a recipient, a subrecipient, and a contractor (2 CFR 200.331), so the classification attaches to the agreement rather than to the organization. Document the reasoning for each determination at the time it is made; reconstructing it during an audit is a losing exercise.

What must a subaward agreement include?

Every subaward must be clearly identified to the subrecipient as a subaward and must carry fourteen federal award identification elements, plus four categories of required terms. The list at 2 CFR 200.332(b) obliges the pass-through entity to provide the best available information and to supply anything missing once obtained.

• Identification of the parties and the award. Subrecipient name matching its unique entity identifier registration, the subrecipient’s unique entity identifier, the Federal Award Identification Number, and the federal award date.
• Dates and dollars. Subaward period of performance and budget period start and end dates, federal funds obligated by this action, total federal funds obligated to the subrecipient to date, and the total federal award amount committed to the subrecipient.
• Program identity. The federal award project description as required by the transparency statute, the awarding agency and pass-through entity with the awarding official’s contact information, the Assistance Listings title and number with the dollar amount made available under each listing at the time of disbursement, and whether the award is for research and development.
• Rate and requirements. The indirect cost rate for the award, all federal statutory and regulatory requirements and award terms, any additional requirements the pass-through entity imposes to meet its own obligations, a right of access to the subrecipient’s records and financial statements, and closeout terms for the subaward.

The indirect cost provision is where pass-through entities most often go wrong. A subrecipient with a federally negotiated rate is entitled to it; where none exists, the pass-through entity must determine an appropriate rate “in collaboration with the subrecipient,” which may be a rate negotiated between the two parties, a rate previously negotiated with a different pass-through entity, or the de minimis rate (2 CFR 200.332(b)(4)(i)).

The prohibition is stated directly: “The pass-through entity must not require the use of the de minimis indirect cost rate if the subrecipient has an approved indirect cost rate negotiated with the Federal Government” (2 CFR 200.332(b)(4)(ii)). A blanket internal policy capping subrecipient indirect at a lower number, absent a statutory or prime-award limit, is a finding waiting to happen.

Flow-down is the mechanism that carries the prime award’s obligations downhill. The terms you extracted while reading the Notice of Award become the requirements clause of the subaward, and anything you omit is an obligation you have retained.

How do you assess subrecipient risk before making a subaward?

Risk assessment is mandatory and precedes monitoring design. A pass-through entity must “evaluate each subrecipient’s fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring” (2 CFR 200.332(c)). The assessment is per subaward, not a one-time vendor approval.

Four factors are named in the regulation. Prior experience with the same or similar subawards. The results of previous audits, including whether the subrecipient receives a Single Audit and the extent to which similar subawards were audited as a major program. Whether the subrecipient has new personnel or new or substantially changed systems. The extent and results of any federal agency monitoring, which matters where the subrecipient also holds direct awards.

Practical inputs make those factors answerable: the subrecipient’s most recent audit reporting package and any findings, its financial statements and liquidity, its history of on-time reporting to you, the size of the subaward relative to its total budget, the complexity of the program requirements involved, and whether key staff named in the proposal are still in place. Organizational capability questions overlap substantially with the criteria in a grant readiness assessment.

Assessed risk then drives two decisions. The first is whether to impose specific conditions on the subaward — the pass-through entity may apply the same conditions an agency may apply, and must notify the federal agency when it does (2 CFR 200.332(d)). The second is monitoring intensity, discussed next.

What subrecipient monitoring activities are required?

Four monitoring activities are mandatory for every subrecipient regardless of size or assessed risk, and they are stated as obligations of the pass-through entity at 2 CFR 200.332(e).

• Review financial and performance reports. Reviewing means reconciling and questioning, not filing. Reported expenditures should agree with invoices, and reported performance should agree with the subaward’s objectives.
• Ensure corrective action on significant developments that negatively affect the subaward. Significant developments expressly include Single Audit findings related to the subaward, other audit findings, site visits, and written notifications from the subrecipient of adverse conditions. The subrecipient must supply its corrective action plan and identify assistance needed.
• Issue a management decision for audit findings pertaining to the subaward, as required by 2 CFR 200.521. The decision must state whether the finding is sustained, the reasons, and the expected action including repayment of disallowed costs, and it is due within the period in the figures above.
• Resolve audit findings specifically related to the subaward. The pass-through entity is not responsible for resolving cross-cutting findings that reach other awards, and may rely on the subrecipient’s cognizant or oversight agency for audit follow-up on those, provided the subrecipient has a current Single Audit report and is not excluded. Reliance does not relieve the pass-through entity of issuing conforming subawards, managing risk through ongoing monitoring, or monitoring the status of subaward-specific findings.

Beyond the mandatory four, the pass-through entity must verify that the subrecipient is audited as required (2 CFR 200.332(g)), consider whether monitoring results require adjustments to its own accounting records (2 CFR 200.332(h)), and consider enforcement action against a noncompliant subrecipient under 2 CFR 200.339.

Three additional tools are discretionary and scale with assessed risk: training and technical assistance on program matters, site visits to review the subrecipient’s program operations, and agreed-upon-procedures engagements (2 CFR 200.332(f)). Agreed-upon-procedures engagements are a defined allowable cost for monitoring subrecipients exempt from Single Audit, provided they are conducted under government auditing standards, arranged and paid for by the pass-through entity, and limited in scope to activities allowed, allowable costs, eligibility, and reporting (2 CFR 200.425(c)).

For-profit subrecipients need a separate answer. Subpart F does not apply to for-profit organizations, so the pass-through entity “is responsible for establishing requirements to ensure compliance,” the subaward must describe the applicable compliance requirements and the for-profit’s responsibility, and acceptable methods include pre-award audits, monitoring throughout performance, and post-award audits (2 CFR 200.501(i)). Assuming an audit will arrive on its own is the most common gap in university and health system subawards to industry partners.

How do you structure a subrecipient monitoring plan?

A workable subrecipient monitoring plan has six components, written once and applied per subaward. The plan is itself a document auditors ask for, so keep it short enough to follow and specific enough to test.

1. Determination. A documented subrecipient-versus-contractor classification for each agreement, naming the indicators relied on and the person who decided.
2. Risk assessment. A scored assessment against the regulatory factors, refreshed at each new subaward and at each continuation, with the resulting risk tier recorded.
3. Monitoring schedule by risk tier. Desk monitoring for lower-risk subrecipients — invoice review, report review, and audit verification. Enhanced monitoring for higher-risk subrecipients — transaction testing, more frequent reporting under a specific condition, technical assistance, or a site visit.
4. Subaward terms checklist. The fourteen data elements plus required terms, verified before execution rather than after the first invoice arrives.
5. Audit tracking. A register of each subrecipient’s fiscal year end, audit status, findings related to your subaward, management decisions issued, and corrective action status.
6. Escalation path. Named triggers and named owners for withholding payment, imposing conditions, and recommending enforcement action, so escalation is a procedure rather than an argument.

Desk monitoring and on-site monitoring answer different questions. Desk monitoring tests whether reported numbers are internally consistent and supported by invoices and reports. On-site monitoring — which may be conducted in person or virtually (2 CFR 200.329(f)) — tests whether the program described in the reports is the program actually operating, and whether the subrecipient’s own controls, timekeeping, and procurement practices hold up. Higher risk buys the second kind.

Reporting obligations run on their own clock. Subrecipients must submit final financial and performance reports to the pass-through entity and liquidate all obligations within the period in the figures above (2 CFR 200.344(b)–(c)), which is deliberately earlier than the prime’s own final deadline. Each first-tier subaward at or above the transparency threshold must also be reported by the prime recipient, as covered under grant reporting requirements.

This article is general information about federal pass-through obligations, not legal or accounting advice. Subrecipient determinations, subaward terms, and monitoring adequacy for a specific award should be confirmed with your auditor and the awarding agency.

What goes wrong in subrecipient monitoring?

Subrecipient monitoring fails in patterns, and the patterns are consistent enough to check against. Each one converts a subrecipient’s problem into the pass-through entity’s disallowed cost.

• Classifying by document title. An agreement called a contract that has the subrecipient making eligibility decisions and program judgments is a subaward, and auditors will re-characterize it.
• Issuing subawards from a template. Templates drift from award terms, omit required data elements, and forget closeout provisions.
• Capping indirect by policy. A blanket cap applied to a subrecipient holding a negotiated rate is non-compliant absent a statutory or prime-award limitation.
• Risk assessment as a formality. A scoring sheet that produces the same tier for every subrecipient produces no monitoring design and no defense.
• Filing reports instead of reviewing them. Unreviewed reports are indistinguishable from unreceived reports in an audit.
• No management decision on findings. A finding acknowledged but never decided leaves the finding open, and the deadline runs from the clearinghouse’s acceptance of the audit, not from your discovery of it.

The aggregate record is documented rather than anecdotal. The Government Accountability Office found that of $6.97 trillion in direct federal award funds from 2017 through 2021, $1.17 trillion was associated with audit findings that were both severe and persistent, and identified 213 findings reported in 2015 or earlier that remained unresolved in 2021 (GAO-24-106173). Findings that no one resolves do not expire; they accumulate.

Frequently asked questions

What is the difference between a subrecipient and a contractor?

A subrecipient carries out part of the federal program, makes programmatic decisions, and is responsible for federal program compliance. A contractor provides goods or services within its normal business operations to many purchasers and is not subject to program compliance because of the agreement. Substance controls, not the agreement’s form.

Does a pass-through entity have to monitor every subrecipient?

Yes. The four required monitoring activities apply to every subrecipient. What varies with assessed risk is intensity — the discretionary tools of training, site visits, and agreed-upon-procedures engagements, and whether specific conditions are imposed on the subaward.

Can a pass-through entity require a subrecipient to accept a lower indirect rate?

Not where the subrecipient holds a federally negotiated rate. The pass-through entity must not require the de minimis rate in place of a negotiated rate. Where no negotiated rate exists, the rate is set collaboratively and may be a negotiated rate or the de minimis rate.

Who issues the management decision on a subaward audit finding?

The pass-through entity, for findings that pertain to the subaward it issued. The decision must state whether the finding is sustained, the reasons, and the expected action, and it is due within six months of the Federal Audit Clearinghouse’s acceptance of the audit report.

What monitoring applies to a for-profit subrecipient?

Single Audit requirements do not reach for-profit organizations, so the pass-through entity must establish alternative assurance. The subaward must describe the applicable compliance requirements and the for-profit’s responsibility, and methods include pre-award audits, monitoring during performance, and post-award audits.

Does a subrecipient’s spending count toward its own audit threshold?

Yes. Federal awards expended as a subrecipient count alongside direct federal awards in determining whether the subrecipient must have a Single Audit. Organizations receiving most of their federal funding through pass-through entities are frequently surprised by crossing the threshold.

Related topics

• Managing the Award — the hub for reporting, prior approval, monitoring, audit, and closeout
• The Single Audit
• Prior Approval and Changing a Grant
• Internal Controls for Grant Recipients

Sources

1. Electronic Code of Federal Regulations, 2 CFR 200.331, “Subrecipient and contractor determinations.” https://www.ecfr.gov/current/title-2/section-200.331 (accessed 2026-08-11)
2. Electronic Code of Federal Regulations, 2 CFR 200.332, “Requirements for pass-through entities.” https://www.ecfr.gov/current/title-2/section-200.332 (accessed 2026-08-11)
3. Electronic Code of Federal Regulations, 2 CFR 200.1, “Definitions” (subaward; subrecipient; pass-through entity; modified total direct cost). https://www.ecfr.gov/current/title-2/subtitle-A/chapter-II/part-200/subpart-A/section-200.1 (accessed 2026-08-11)
4. Electronic Code of Federal Regulations, 2 CFR 200.501, “Audit requirements.” https://www.ecfr.gov/current/title-2/section-200.501 (accessed 2026-08-11)
5. Electronic Code of Federal Regulations, 2 CFR 200.521, “Management decisions.” https://www.ecfr.gov/current/title-2/section-200.521 (accessed 2026-08-11)
6. Electronic Code of Federal Regulations, 2 CFR 200.339, “Remedies for noncompliance.” https://www.ecfr.gov/current/title-2/section-200.339 (accessed 2026-08-11)
7. Electronic Code of Federal Regulations, 2 CFR 200.344, “Closeout.” https://www.ecfr.gov/current/title-2/section-200.344 (accessed 2026-08-11)
8. Electronic Code of Federal Regulations, 2 CFR 200.414, “Indirect costs.” https://www.ecfr.gov/current/title-2/section-200.414 (accessed 2026-08-11)
9. Electronic Code of Federal Regulations, 2 CFR 200.425, “Audit services.” https://www.ecfr.gov/current/title-2/section-200.425 (accessed 2026-08-11)
10. Electronic Code of Federal Regulations, 2 CFR 200.329, “Monitoring and reporting program performance.” https://www.ecfr.gov/current/title-2/section-200.329 (accessed 2026-08-11)
11. Electronic Code of Federal Regulations, 2 CFR 180.300, “What must I do before I enter into a covered transaction with another person at the next lower tier?” https://www.ecfr.gov/current/title-2/section-180.300 (accessed 2026-08-11)
12. Electronic Code of Federal Regulations, 2 CFR part 170, Appendix A, “Award Term — Reporting Subawards and Executive Compensation.” https://www.ecfr.gov/current/title-2/part-170/appendix-Appendix%20A%20to%20Part%20170 (accessed 2026-08-11)
13. U.S. Government Accountability Office, GAO-24-106173, “Single Audits: Improving Federal Audit Clearinghouse Information and Usability Could Strengthen Federal Award Oversight,” April 22, 2024. https://www.gao.gov/products/gao-24-106173 (accessed 2026-08-11)