Every federal agency runs a pre-award risk assessment on grants before it releases a dollar, and most applicants picture it as a scoring worksheet a program officer fills out after reading the narrative. That is the wrong mental model. The risk review is a records check, and under 2 CFR Part 200 Subpart C it can produce something the application never does: a durable entry in a federal database that every other agency reads for the next five years. The Department of Veterans Affairs, for one, documents in its published grant policy that program offices assign each applicant a low, medium, or high risk level before award. You will never see that rating. You can see the file it was built from.

What the Pre-Award Risk Assessment Reads Before Your Budget

Section 200.206(a) sets out two mandatory lookups that happen independent of your proposal. First, the agency reviews eligibility and financial integrity information in OMB-designated databases under the Payment Integrity Information Act of 2019 and the Do Not Pay Initiative at 31 U.S.C. 3354. Second, where the dollar threshold is met, it pulls the responsibility and qualification records in the non-public segment of SAM.gov.

That second lookup is broader than most applicants assume. The rule at 2 CFR 200.206 requires the agency to consider information about the applicant and any immediate highest-level owner, predecessor organization, or subsidiary identified in SAM.gov. If your nonprofit absorbed a struggling affiliate two years ago, or your company was spun out of a parent that had a termination for cause, that history is inside the search radius. The statutory hook is 41 U.S.C. 2313, added by the FY2013 National Defense Authorization Act, which is why the same records drive contractor responsibility determinations under FAR 9.104-6.

The information in those records “must demonstrate a satisfactory record of administering programs or activities under Federal financial assistance or procurement awards, and integrity and business ethics.” That is the standard. An agency may still fund an applicant who does not fully meet it, either by deciding the information is not relevant to this particular award or by attaching conditions that mitigate the risk. Both outcomes are common. Silent rejection is the rare one.

The $250,000 Line That Decides How Hard You Get Checked

The SAM.gov responsibility check is not universal. Section 200.206(a)(2) makes it mandatory only where the federal share of the award “is expected to exceed the simplified acquisition threshold” — defined at 41 U.S.C. 134 and currently set at $250,000 — measured over the period of performance rather than annually. A four-year award at $80,000 per year clears the line at $320,000 even though no single year comes close.

This matters for how you sequence applications. An organization with an unresolved audit finding or a recent termination in its history is in a materially different position applying for a $150,000 two-year project than a $400,000 three-year one, and the difference is not proportional. Below the threshold, the deep records pull is discretionary. Above it, the agency is required to look and required to consider what it finds. Applicants building toward larger federal awards frequently do better staging up through smaller ones while clearing the record, and a filtered search across federal grant programs makes that sequencing visible before you commit staff time to a proposal.

The threshold also governs the reporting side. Under 200.213, an agency reports a not-qualified determination only when the expected federal share exceeds the same threshold. Small awards do not create the record. Large ones can.

The Five Factors, and Which Two Actually Create a Record

Section 200.206(b)(2) lists what an agency should weigh: financial stability, the quality of your management systems, your history of performance on prior and current federal awards, audit reports and findings under Subpart F, and your ability to implement the statutory and regulatory requirements the award imposes. Agencies may also weigh application quality, award size, program risk, cybersecurity risk, and fraud risk.

Here is the part that gets skipped. Section 200.206(b)(1) requires that “the risk criteria to be evaluated must be described in the announcement of the funding opportunity.” The factors an agency will actually apply to you are published in the NOFO, usually buried in the section on award administration rather than the evaluation criteria most readers skim. Reading that paragraph tells you which of the five factors carries weight for this program before you decide whether to apply.

Of the five, only two can trigger a reportable determination. Under 2 CFR 200.213, an agency must report a not-qualified finding in SAM.gov only if the sole basis was the applicant’s prior record of performance on federal awards or its record of integrity and business ethics — and only above the threshold. Get declined because your management systems are thin or your financial statements are weak, and nothing is filed. Get declined because of how you handled the last award, and a five-year entry follows you to every other agency.

What lands in the file

The record types are specific: terminations for cause, terminations for default, terminations for material failure to comply, non-responsibility determinations, recipient not-qualified determinations, administrative agreements, defective pricing findings, and subcontractor payment issues. Separately, Appendix XII to Part 200 requires recipients holding more than $10,000,000 in active federal awards to self-report civil, criminal, and administrative proceedings, on a semiannual cycle — civil findings of $5,000 or more, administrative findings of $5,000 or more in penalties or over $100,000 in restitution.

Pull Your Own File: A Thirty-Minute SAM.gov Audit

Almost nobody does this, and it is the highest-leverage half hour in pre-award compliance. Responsibility and qualification records — the data formerly hosted at FAPIIS.gov — now live inside SAM.gov entity information. The public segment requires only a signed-in Login.gov account, no special role. Search by Unique Entity ID, CAGE code, or entity name, then open Responsibility/Qualification on the entity record. Bulk data is downloadable from the SAM.gov Data Bank under Entity Information.

Three timing rules are worth writing down. Newly posted R/Q information carries a 14-calendar-day delay before it appears publicly, so a determination filed today is invisible for two weeks — check again after any adverse award decision. If information posted publicly is covered by a FOIA disclosure exemption, you have seven calendar days to assert that to the posting agency, and the agency must remove the posting within seven calendar days of your assertion. And 200.213 gives you a right most applicants never exercise: you may review the records and comment on any information the system holds about you, and every agency evaluating you for the next five years must consider that comment alongside the underlying entry.

That comment is not an appeal and it will not delete the record. It is context — the corrective action plan you completed, the finding you closed, the successor entity that has no operational overlap with the predecessor. Written once, it travels with the file. Organizations that run this audit before a major submission rather than after a denial are the ones whose records read cleanly. If you are managing this across a portfolio of awards, the same discipline applies whether you sit on the nonprofit grants side or pursue small business grant programs.

If Conditions Land Anyway: Reading a 200.208 Notice

The usual output of an unfavorable risk read is not a denial. It is an award with strings. 2 CFR 200.208 lets an agency adjust conditions based on the SAM.gov review, your compliance history, your ability to meet performance goals, or a finding of inadequate financial capability. The menu is short and predictable: reimbursement instead of advance payments, withheld authority to proceed to the next project phase, additional or more detailed financial reports, added project monitoring, mandatory technical or management assistance, and extra prior approvals.

The reimbursement condition is the one that hurts operationally. Shifting from advance payment to reimbursement moves the entire cash cycle onto your balance sheet, and organizations that accept the award without modeling that shift discover the problem at the first drawdown. The Department of Labor spells the same list out in its standard award terms, which is a useful preview of how a specific agency words these.

Section 200.208(d) is your leverage. Before imposing conditions the agency must notify you of the nature of the condition, the reason it is being imposed, the action needed to remove it, the time allowed to complete that action, and the method for requesting reconsideration. If a notice arrives missing any of those five elements, ask for them in writing. And 200.208(e) requires that conditions “must be promptly removed once the conditions that prompted them have been satisfied” — removal is an obligation on the agency, but it is triggered by your evidence, not by the calendar.

What Changes If the October Rule Lands

OMB published a proposed Regulation for Federal Financial Assistance on May 29, 2026, converting the Uniform Guidance from guidance into binding regulation. The comment period closed July 13, 2026, with a targeted effective date of October 1, 2026 — though appropriations text moving through the Senate in early August would push implementation to December 11.

The proposal expands 200.206 substantially. Legal analysts at Venable flag three new risk considerations: a “history of questionable practices” including plagiarism and discredited studies, membership in or affiliation with organizations engaged in specified categories of activity, and compliance with foreign gift reporting under Section 117 of the Higher Education Act. A revised 200.205 would add pre-issuance review by senior political appointees for discretionary awards. Several of these terms are undefined, and both analyses note the litigation exposure that follows.

The practical read for applicants is narrower than the headlines. Whatever survives rulemaking, the mechanics stay the same: a records check, a threshold trigger, a five-year file, and a comment right. Clean records are the hedge that works under either version of the rule. Track the final text through the grant policy and industry news feed as October approaches.

Frequently Asked Questions

Can I find out my risk rating?

No. The rating itself — VA’s low/medium/high scale, for example — is internal deliberative material and agencies do not release it. What you can retrieve is the underlying data: your SAM.gov responsibility and qualification records, your Single Audit findings in the Federal Audit Clearinghouse, and your own reporting history on prior awards. Those three sources are most of what the assessment runs on.

Does a not-qualified determination disqualify me everywhere?

No. It is information every agency must consider, not a bar. The record archives after five years. In the interim, an agency can still fund you if it decides the information is not relevant to the award at hand or that specific conditions under 200.208 adequately mitigate the risk. Your written comment on the record is part of what the next agency weighs.

Do Single Audit findings automatically trigger a bad risk assessment?

Not automatically. Audit reports and findings are one of five factors, and a single finding with an accepted corrective action plan carries far less weight than a pattern of unresolved material weaknesses. The Single Audit obligation itself attaches at $1,000,000 in federal expenditures in a fiscal year, and agencies issue a management decision on each finding generally within six months of clearinghouse acceptance.

Does the risk review apply to subrecipients?

Yes, but you run it, not the agency. Pass-through entities perform their own subrecipient risk assessments and can impose specific conditions under 200.208 using the same authority. If you subaward, your monitoring file becomes evidence in your own next pre-award review.

When should I run the SAM.gov audit?

Before submitting any application where the federal share will exceed $250,000 over the period of performance, and again within thirty days of any adverse award decision — the 14-day posting delay means a fresh determination will not be visible immediately after the notification arrives.

Bottom Line

Treat the pre-award risk assessment for grants as a file you maintain, not a test you sit. The application is a one-time artifact. The record is cumulative, cross-agency, and five years long — and the only part of it you directly control is the comment you attach and the corrective actions you can document.

The concrete move this week: pull your entity’s Responsibility/Qualification record in SAM.gov, confirm whether any predecessor or affiliate entities carry entries you did not know about, and — if anything is there — draft the 200.213 comment now rather than during the week a submission is due. Then read the risk-criteria paragraph in the next NOFO you are targeting, since 200.206(b)(1) requires the agency to publish exactly which factors it will apply.

If the record has entries you need to work around, the framing of the next application matters more than usual, and that is a place where experienced help pays for itself. OpenGrants’ managed grant writing services can structure a submission that addresses a known risk factor directly rather than hoping the reviewer does not pull the file.