Your Data-Collection System Is Part of Your Audit Trail
Surveys, logs, and tests can become Federal award records. Federal rules do not require you to keep every draft or form configuration — they require retention of the records and supporting documentation that substantiate what you reported. ([2 CFR § 200.334](https://www.ecfr.gov/current/title-2/section-200.334))
Drafted with AI assistance, checked against primary sources, reviewed and approved by Gary Kosman on September 2, 2026.
The form is not the whole file.
Recipients and subrecipients must retain Federal award records, including financial records, supporting documentation, and statistical records, for the applicable retention period. (2 CFR § 200.334)
Here's the boundary worth setting up front: Federal rules do not require organizations to preserve every draft, keystroke, or form configuration. They do require retention of Federal award records and supporting documentation sufficient to substantiate what was reported and demonstrate compliance. (2 CFR § 200.334)
So a survey isn't automatically a Federal award record because it exists; it becomes one when it supports a reported result or a decision under the award, or when your award terms or your own policy say to keep it.
For performance measurement, data collection is supposed to be systematic and regular. (45 CFR § 2522.700) And when reporting program performance, the recipient or subrecipient must relate financial data and project or program accomplishments to the performance goals and objectives of the Federal award. (2 CFR § 200.329 (b))
So when a monitor comes to you with, "Hey, show me where this number came from," they're asking to see the record trail behind a reported accomplishment.
The five-part test
Almost everything below comes back to one question: can another person reconstruct
- what was asked,
- what was submitted,
- what changed,
- who changed it,
- and what ultimately supported the reported number?
If your file answers those five, you're in strong shape. If it doesn't, no amount of software will rescue it.
Recipients and subrecipients must monitor their activities under Federal awards to ensure they're compliant with all requirements and meeting performance expectations. (2 CFR § 200.329) If your grant requires certain outcomes, indicators, targets, baseline data, or data collections, those expectations should be communicated in the Federal award. (2 CFR § 200.301 (a))
And if a grantee fails to collect appropriate data to allow performance measurement, a period of correction may be imposed, and continued failure can lead to actions including grant reduction, suspension or termination, or amendments to grant terms. (45 CFR § 2522.650)
What the rules require, and what good system design adds
Internal control means processes designed and implemented to provide reasonable assurance regarding effective and efficient operations, reliable reporting, and compliance with applicable laws and regulations. (2 CFR § 200.1) Recipients and subrecipients must establish and maintain effective internal control over the Federal award. (2 CFR § 200.303)
What § 200.303 does not do is prescribe a particular technology. Version histories, timestamps, field-level change logs, and form snapshots are strong control design, not federal mandates, unless a specific award term or your own written policy requires them. They're worth building because they make the five-part test easy to satisfy, not because a regulation names them.
One practical way to get there is a short control sheet for each instrument. Not because a regulation says the sheet must exist. Because it keeps your evidence together.
A strong control sheet might include:
- the instrument name and purpose
- the version number and effective date
- which performance measure or internal metric it supports
- who may administer it, and when
- where completed forms are stored
- who reviews completeness and approves the final reported number
Versions, and what to do with drafts
Instruments change mid-year. Totally normal! And when change occurs, set yourself up to say down the road which version produced which number.
Put a version ID on every tool, even if it's basic: Literacy Pre-Test v3, effective 10/1/26. Then keep a small change log. Not a novel. A table is enough.
That log is strong control design, not a cited requirement. But it can save hours during monitoring.
Drafts deserve a gentler rule than either extreme. An incomplete draft isn't automatically disposable, and § 200.334 doesn't explicitly require keeping every draft. (2 CFR § 200.334) The defensible standard is narrower: keep it if it's a Federal award record, if it supports a reported result or decision, or if award terms, your organizational policy, or a litigation or audit hold require it.
Who administers the tool
Many findings start with a simple mismatch. The program report says 82 participants completed a workshop. The attendance logs were filled out by three different staff. One used initials. One counted late arrivals as present. One used a revised form nobody else had.
No regulation prescribes who may administer your data collection tools. Written administrator rules are strong control design, not a federal mandate — and they're what keep the mismatch above from happening. So if volunteers, members, staff, contractors, or subrecipients administer your tools, decide in writing:
- who is allowed to administer each tool
- what training and instructions they receive
- who checks their work
- what happens when forms are incomplete or unusable
Where contractors are involved, recipients and subrecipients must maintain oversight to ensure contractors perform in accordance with the terms, conditions, and specifications of their contracts or purchase orders, and must maintain records sufficient to detail the history of each procurement transaction. (2 CFR § 200.318)
Storage, electronic records, and privacy
Many of these tools contain names, contact information, dates of birth, school information, or other data points that can identify a person. Personally identifiable information is information that can be used to distinguish or trace an individual's identity, alone or when combined with other linked or linkable information. (2 CFR § 200.1)
Which leads to a warning that sits oddly next to a piece about keeping records: more retained data isn't always better. Recipients and subrecipients must take reasonable measures to safeguard protected personally identifiable information and other information the Federal agency or pass-through entity designates as sensitive. (2 CFR § 200.303 (e)) Every extra copy of a member or beneficiary file is one more thing to protect.
On electronic records, read § 200.336 carefully, because it's often overstated. If your original records are electronic and cannot be altered, you don't need to create and retain paper copies. (2 CFR § 200.336) That's a permission, not a requirement that your database be immutable (not changeable). Corrections can be entirely appropriate when your system and procedures preserve reliability and prevent silent replacement of what was there before without a trail.
You may also substitute electronic versions of original paper records through duplication or other forms of electronic conversion. The periodic quality control reviews § 200.336 calls for apply to those substitution procedures specifically — the duplication or conversion process — and they must ensure safeguards against alteration and keep the records readable by a computer system. (2 CFR § 200.336)
A few practical choices help:
- separate blank templates from completed records
- restrict editing rights on completed submissions
- define file naming rules before the reporting period starts
- preserve exports used to calculate reported totals, and keep a read-only copy of the dataset behind the report
Those are control design choices. They line up with what the regulations care about: readability, integrity, and retention.
The retention clock
When survey forms, attendance logs, and pre/post tests are Federal award records or supporting documentation, they're subject to § 200.334's generally applicable three-year retention period, including its exceptions. (2 CFR § 200.334) The general rule ties retention to the final financial report. Recipients and subrecipients must retain all Federal award records for three years from the date of submission of the final financial report. (2 CFR § 200.334) For awards renewed quarterly or annually, the three years run from the date of submission of the quarterly or annual financial report, respectively. (2 CFR § 200.334)
If litigation, a claim, or an audit involving the records starts before the three-year period ends, the records must be retained until the matter is resolved and final action is taken. (2 CFR § 200.334) If you're notified in writing to extend the retention period, keep them for the extended period. (2 CFR § 200.334)
And the Federal agency's or pass-through entity's right of access isn't limited to the required retention period; it lasts as long as the records are retained. (2 CFR § 200.337 (c)) That right of access covers records pertinent to the Federal award. (2 CFR § 200.337) It isn't a blanket entitlement to every piece of platform metadata your software happens to generate.
What to pull when someone says, "Trace this number"
A monitor or auditor may request any of this, and a strong system should be able to produce it on request:
- The reported measure entry. The exact figure as it appeared in the performance report.
- The measure definition. The approved output or outcome language from your award file or reporting instructions. (2 CFR § 200.301)
- The instrument used. The exact version of the survey, log, intake form, or test.
- Raw source records. Completed forms, rosters, scans, system exports, or scored tests.
- The compilation and review. The file that turned raw records into the final count, evidence someone checked completeness and math, and a note on exclusions such as duplicates or invalid tests.
That packet isn't mandated line by line in regulation. It's a practical way to show the relationship between the reported accomplishment, the supporting statistical records, and the controls around them.
Why it matters beyond monitoring: auditors test compliance with statutes, regulations, and award terms that may have a direct and material effect on major programs. (2 CFR § 200.514) And a questioned cost can exist when, at the time of the audit, an amount charged to a Federal award lacked adequate documentation to support compliance. (2 CFR § 200.1) A deficient performance-measure file usually creates a monitoring concern or compliance finding, not automatically a questioned cost. Under 2 CFR § 200.1, a questioned cost is an amount expended or received under a Federal award that an auditor questions because of a possible violation, inadequate documentation, or apparent unreasonableness. (2 CFR § 200.1)
A standard to consider using
You don't need a perfect research archive for every sign-in sheet.
Performance measurement isn't evaluation. It systematically and regularly collects and monitors data to indicate program operations and performance, and it isn't intended to establish a causal relationship between the program and the outcome. (45 CFR § 2522.700)
What you do need is a record trail another reasonable person can follow without guessing. Back to the five: what was asked, what was submitted, what changed, who changed it, and what supported the number.
Before you finalize your process, verify your retention and records practices against the current eCFR text and your own award terms and conditions. Practice varies at the edges, but the principle is steady: if it supports what you reported, keep it like it matters.
You've got this.
A quick reminder
AmeriCorps grants can vary from one to the next. If you’re unsure how a rule applies to your program, check with your commission or designated point of contact at the AmeriCorps agency for any additional guidance and clarifications. They know your award terms best.
Questions people ask
- Do surveys and attendance logs count as Federal award records?
When survey forms, attendance logs, and pre/post tests are Federal award records or supporting documentation behind something you reported, they're subject to § 200.334's generally applicable three-year retention period, including its exceptions. (2 CFR § 200.334) A blank template or an abandoned draft isn't automatically in that category — the test is whether it supports a reported result or decision, or whether award terms or your own policy require keeping it.
- When does the three-year retention period start for performance measurement source documents?
The general rule is three years from the date of submission of the final financial report. (2 CFR § 200.334) For awards renewed quarterly or annually, the three years run from submission of the quarterly or annual financial report for that award cycle. (2 CFR § 200.334)
- Can we scan paper intake forms and destroy the originals?
You may substitute electronic versions of original paper records through duplication or other electronic conversion. (2 CFR § 200.336) The periodic quality control reviews apply to those substitution procedures specifically, and they must ensure safeguards against alteration and keep the records readable by a computer system. (2 CFR § 200.336)
- Does 2 CFR 200.336 mean our database can never allow corrections?
No. Section 200.336 says that when original records are electronic and cannot be altered, you don't need to print and keep paper copies. (2 CFR § 200.336) That's a permission, not a universal immutability requirement. Corrections can be appropriate when your system and procedures preserve reliability and prevent silent replacement of the earlier entry.
- Are version histories and change logs required?
Not by name. Section 200.303 requires effective, documented internal control over the Federal award, but it doesn't prescribe particular technologies. (2 CFR § 200.303) Version histories, timestamps, and field-level change logs are strong control design — worth building, and sometimes required by a specific award term or your own policy, but not a blanket federal mandate.
- What can a monitor or auditor ask to see?
The right of access covers records pertinent to the Federal award. (2 CFR § 200.337) That access isn't limited to the required retention period; it lasts as long as the records are retained. (2 CFR § 200.337 (c)) It also isn't an automatic entitlement to every piece of platform metadata your software generates.
- What if my grant comes through a state or territory service commission?
- Check your commission’s current requirements too. They may be stricter than the federal floor, and stricter is what you follow. What a commission can’t do is override controlling federal law, regulation, or your AmeriCorps award terms, and it can grant only the waivers it’s authorized to grant. Read this post alongside your commission’s guidance, your award terms, and your written policies — and when something looks like a real conflict, ask your commission or program officer rather than guessing.
About the author
Gary Kosman is the founder and CEO of America Learns. He has worked with AmeriCorps programs and state service commissions for more than two decades, helping organizations strengthen the systems they use to manage members, grants, reporting, compliance, and impact. Reach him at gary@americalearns.net or 310-689-0542 x101.
Last reviewed September 2, 2026. Regulations change. Verify every citation against the current eCFR text and your own grant terms and conditions before you rely on it.
Looking for another topic?
Browse all compliance topics — from timesheets and member files to financial and progress reporting.
Browse topicsKeep reading on performance measurement and related topics
OIG Findings/September 4, 2026
How Commissions Can Catch Timesheet and Term Errors Early
When education awards are tied to weak time records or unsupported service-term changes, the cost lands late and hard. A commission can catch most of it before exit with a tighter review sequence.
2 CFR 200 Basics/August 18, 2026
When Staff Duties and Timesheets Don’t Match
Salary costs get vulnerable when payroll support, payroll charges, and the role described in your award materials stop lining up. The fix starts with a clean match between supported work, the amount charged, and the staffing picture your award says you funded.
Member Timesheets/August 12, 2026
What AmeriCorps Members Cannot Do on Service Time
The first question is about time and duties. If a member or staff person engages in a prohibited activity while charging time to the AmeriCorps program, accumulating service or training hours, or otherwise performing activities supported by the AmeriCorps program or AmeriCorps, your program should review the record promptly under its written procedures, award terms, and any applicable AmeriCorps or pass-through instructions. Private-citizen participation in the listed activities has its own conditions too, including a logo instruction in the regulation.
Member Files/August 12, 2026
Build Member Files Before Enrollment Day Arrives
The cleanest member file is the one you build before the first enrollment rush hits. Set up the file once, in the right order, so eligibility, applicable criminal history check records, and core member documents line up all year.
Subgrantee Monitoring/August 7, 2026
How to Read a Subgrantee Financial Report Like a Monitor
A clean expenditure report can still hide weak support. Your job as a monitor is to tie each line to the accounting records, payroll or activity records, and match support, then follow every variance until it makes sense.