How to Build a Subrecipient Risk Matrix That Holds Up

The job nobody trained you for

You're carrying responsibility that feels bigger than your title.

That feeling is real.

If you run a state service commission, or you're the parent organization passing grant funds to local sites, 2 CFR § 200.332 gives you oversight duties over those subawards. The subrecipient is still responsible for its own compliance. And you, as the pass-through entity, must identify required subaward information, evaluate each subrecipient's fraud risk and risk of noncompliance, monitor as needed, verify that required audits happen, and follow up on audit issues that touch your federal award.

That's the work.

It gets easier when you stop treating monitoring like instinct and start treating it like sequence.

Step one: put the required terms in writing

Before the subaward starts, the pass-through entity must make sure every subaward is clearly identified to the subrecipient as a subaward and includes the information listed in 2 CFR § 200.332(b).

This is where files go thin.

The regulation's list is longer than the shorthand most of us carry around in our heads. It includes Federal Award Identification elements and other required terms, such as:

• the subrecipient's name and UEI
• the federal award date
• the subaward period of performance
• the amount of federal funds obligated by the action, and the total amount obligated to date
• the total amount of the federal award committed to the subrecipient
• the federal award project description, as required to meet the government's transparency rules
• the name of the federal awarding agency, the pass-through entity, and contact information for the awarding official
• the Assistance Listings number and title, if known
• whether the award is research and development
• the applicable indirect cost rate
• all requirements imposed by the pass-through entity so the subrecipient can meet the federal award requirements
• applicable federal requirements and the terms and conditions of the subaward
• a requirement to permit access to records as described in 2 CFR § 200.337

The safest practice is to place these items in the written subaward or in clearly incorporated written award documents.

A kickoff call matters.

It doesn't replace the paperwork.

Step two: evaluate risk before you choose the monitoring plan

Worry shows up here.

You may think, "We know these organizations. We have worked with them for years. Do we really need to score this?"

Yes.

Under 2 CFR § 200.332(c), the pass-through entity must evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate monitoring. Both halves matter. A subrecipient can be conscientious about the rules and still sit in a spot where fraud is easy — one person handling every step, no second set of eyes, cash moving quickly at the end of a period. That's a fraud-risk question, and the regulation asks you to look at it.

The regulation says a pass-through entity should consider:

• the subrecipient's prior experience with the same or similar subawards
• the results of previous audits, including whether the subrecipient receives a Single Audit and what that showed
• whether the subrecipient has new personnel or new or substantially changed systems
• the extent and results of any Federal agency monitoring, for example when the subrecipient also receives federal awards directly

That list is what the regulation names. It isn't a ceiling on what you're allowed to look at. Plenty of pass-through entities also weigh what their own prior monitoring turned up, how much money is moving, and how complex the subaward is. Those are sound internal controls — just be clear with yourself and your auditor that they're your additions, not requirements pulled from the regulation.

What doesn't belong on the required-factor list is whether specific conditions are needed. That's a possible response to risk, not one of the named risk factors. If your assessment shows extra guardrails are needed, review 2 CFR § 200.208.

Build a matrix that changes what you do next

A risk matrix isn't the law.

It's your documented method.

That matters because a documented method is easier to defend than a memory. It's also kinder to your staff. Nobody has to guess what "high risk" means in April if you already defined it in October.

Here's one example.

Risk factor	Low (1)	Medium (2)	High (3)
Prior audit or monitoring issues	None recently	Minor issues, resolved	Repeat or unresolved issues
Staff or system changes	Stable team and systems	One major change	Multiple key changes or new systems
Subaward size relative to organization	Small share of budget	Moderate share	Large share of budget
Program structure	One site, one model	Multiple sites or moving parts	Multiple sites and multiple models
Experience as a subrecipient	Several years	Some experience	First year
Single Audit history, if applicable	Timely, no relevant findings	Timely with limited issues	Relevant findings or recurring lateness

Add the scores.

Then assign monitoring steps in advance.

That's the point.

If your matrix doesn't change the monitoring plan, it's decoration.

Common practice is to set internal score bands. For example, a lower score may lead to routine report review with limited supplemental testing, while a higher score may trigger an on-site review, targeted file testing, or added technical assistance. Practice varies. Your own award terms and conditions may also require particular monitoring steps, so check those too.

Know what monitoring is required, and what's optional

This is where precision matters.

Under 2 CFR § 200.332(e), the pass-through entity must monitor subrecipient activities as necessary to ensure the subrecipient complies with federal statutes, regulations, and the terms and conditions of the subaward, and is responsible for monitoring overall performance so the goals and objectives of the subaward are met. That paragraph also spells out four things monitoring must include: reviewing financial and performance reports, ensuring corrective action on significant developments that negatively affect the subaward, issuing a management decision on audit findings that pertain to the subaward, and resolving audit findings specifically related to the subaward.

That required monitoring includes:

• reviewing financial and performance reports required by the pass-through entity
• following up and ensuring the subrecipient takes timely and appropriate action on deficiencies related to the federal award identified through audits, on-site reviews, or other means
• issuing management decisions for audit findings pertaining to the federal award provided to the subrecipient, as required by 2 CFR § 200.521

Then there are additional tools that, depending on the risk you assessed, may be useful under 2 CFR § 200.332(f):

• on-site reviews
• training and technical assistance on program-related matters
• agreed-upon-procedures engagements under 2 CFR § 200.425
• verifying that a subrecipient has an audit required by 2 CFR part 200, subpart F

So no, you can't decide that a low-risk subrecipient gets no monitoring.

You can decide that a lower-risk subrecipient mainly receives timely report review and targeted follow-up, while a higher-risk subrecipient receives deeper testing and more hands-on oversight.

Write down why.

That sentence in the file helps more than the sentence in your head.