Insights · Compliance
Subrecipient Monitoring: Subrecipient vs Contractor and What a Pass-Through Entity Owes
Subrecipient monitoring starts with one call most nonprofits make on autopilot: is this partner a subrecipient or a contractor? Here is how 2 CFR 200.331 decides it, what 200.332 then requires, what a monitoring file should hold, and how gaps surface as Single Audit findings.
The short version
- Subrecipient monitoring is the set of duties a nonprofit takes on when it passes part of a federal award to another organization. Once it does, it is a pass-through entity under 2 CFR 200.1.
- The pass-through entity decides, case by case, whether each partner is a subrecipient or a contractor. Substance beats the label on the agreement, and no single factor decides it (2 CFR 200.331).
- For a subrecipient, 2 CFR 200.332 requires a SAM.gov exclusion check, a subaward with 14 listed data elements, a fraud and noncompliance risk evaluation, ongoing monitoring, and verification of the subrecipient's audit.
- A subrecipient's federal spending counts toward its own Single Audit threshold of $1,000,000. Payments a contractor receives do not (2 CFR 200.501(g)).
- Auditors test this as compliance requirement M, Subrecipient monitoring, on the FAC findings form.
The classification call comes first
2 CFR 200.331 puts the decision on the pass-through entity, agreement by agreement. An entity can be a recipient, subrecipient, and contractor at once, traits from both lists may appear, and "the substance of the relationship is more important than the form of the agreement." The awarding agency may add guidance that does not conflict.
Under 2 CFR 200.1, a subaward lets the subrecipient "carry out part of a Federal award," while a contract is how a recipient "conducts procurement transactions." A subaward can live inside a document the parties call a contract.
Most misclassification, we think, happens because nobody made a call. Someone signed the partner's template.
Subrecipient vs contractor: a decision table
A working test, not a scoring sheet:
| Question | Points to subrecipient (200.331(a)) | Points to contractor (200.331(b), cells marked * are our reading) |
|---|---|---|
| Who decides who gets served? | The partner determines who is eligible to receive what federal assistance | * Nobody; it sells to the pass-through entity |
| How is performance judged? | Against whether federal program objectives were met | * Against delivery of what was ordered |
| Who makes program decisions? | The partner has responsibility for programmatic decision-making | * The pass-through entity |
| Do program rules flow down? | The partner is responsible for federal program requirements in the award | Not subject to program compliance requirements because of the agreement |
| Whose purpose does it serve? | Implements a program for a public purpose in the authorizing statute | Provides goods or services for the pass-through entity's own use, ancillary to the program |
| What does the partner normally do? | Runs programs | Provides similar goods or services to many purchasers, in a competitive market, within normal business operations |
Write the answer down. A signed, dated one-page memo per agreement is the cheapest audit evidence a nonprofit will ever produce.
Why the label changes the money
Indirect costs. Modified total direct costs (MTDC) include only the first $50,000 of each subaward but contracted services in full (2 CFR 200.1). Call a $300,000 subaward a contract and the indirect cost base is overstated by $250,000.
The partner's audit. Federal awards expended as a subrecipient count toward the partner's Single Audit threshold; contractor payments do not (2 CFR 200.501(a) and (g)). Our Single Audit threshold guide covers the $1,000,000 test.
The pass-through entity's own SEFA. The schedule of expenditures of federal awards must show the total amount provided to subrecipients from each federal program (2 CFR 200.510(b)(4)). Misclassification makes that line wrong.
Contractors are not free of rules. Where a contractor is made responsible for program requirements, the contract must say so and its records get reviewed (2 CFR 200.501(h)).
What 2 CFR 200.332 requires of a pass-through entity
Once a partner is a subrecipient, 200.332 lists the duties:
- Verify the subrecipient is not excluded or disqualified, including by confirming in SAM.gov that it is not suspended or debarred (200.332(a)).
- Clearly identify the agreement as a subaward and include the required information (200.332(b)), covered below.
- Evaluate each subrecipient's fraud risk and risk of noncompliance to set the level of monitoring (200.332(c)).
- Consider specific conditions under 200.208 where appropriate, and notify the federal agency of them (200.332(d)).
- Monitor: review financial and performance reports, ensure corrective action on significant developments, and issue management decisions on findings related to the subaward (200.332(e)).
- Verify the subrecipient is audited as required by Subpart F (200.332(g)).
- Consider adjustments to its own records after audits or site visits, and enforcement under 200.339 where needed (200.332(h) and (i)).
OMB's 2024 preamble says it revised 200.332(c) so pass-through entities evaluate fraud risk in addition to noncompliance risk. Policies that mention only noncompliance are out of date for awards issued on or after October 1, 2024.
The subaward data elements, and the indirect rate
Under 200.332(b)(1), each subaward must carry federal award identification:
- Subrecipient name, matching the name tied to its unique entity identifier, and the UEI itself
- Federal Award Identification Number (FAIN) and Federal Award Date
- Subaward period of performance start and end dates, and budget period start and end dates
- Federal funds obligated in this action, total federal funds obligated to the subrecipient including this action, and total amount of the federal award committed to the subrecipient
- The federal award project description required by FFATA
- Names of the federal agency and the pass-through entity, and contact information for the pass-through entity's awarding official
- Assistance Listing title and number, with the dollar amount under each award and Assistance Listing number identified at the time of disbursement
- Whether the award is for research and development
- The indirect cost rate, including whether the de minimis rate is used
Missing data gets the best available information now and the rest when obtained. The subaward must also carry the award's requirements, any added pass-through requirements, record access for the pass-through entity and auditors, and closeout terms (200.332(b)(2) to (6)).
On rates, the pass-through entity must use a subrecipient's federally negotiated rate (200.332(b)(4); 200.414(d)). Without one, the parties negotiate a rate or the subrecipient uses the de minimis rate: up to 15 percent of MTDC, chosen by the subrecipient, and not to be pushed lower unless a federal statute or regulation requires it (200.414(f)). Our indirect cost rates guide works the math.
Risk assessment: what to weigh
200.332(c) names four factors a pass-through entity should consider:
- Prior experience with the same or similar subawards
- Results of previous audits, including whether the subrecipient gets a Single Audit and whether similar subawards were audited as a major program
- New personnel, or new or substantially changed systems
- The extent and results of federal agency monitoring, for example where the subrecipient also holds direct federal awards
The rating should drive the tools in 200.332(f), such as site visits or agreed-upon procedures engagements under 200.425. A form that rates every partner "low" and changes nothing is, in our view, worse than none: it documents that the step was skipped.
What a subrecipient monitoring file should contain
Our interpretation of what lets an auditor tie each duty to evidence, one file per subaward:
- Determination memo under 200.331, signed and dated.
- SAM.gov exclusion check, printed or saved with the date.
- Risk assessment covering fraud and noncompliance, with the four 200.332(c) factors and the resulting monitoring plan.
- The executed subaward, checked against the 200.332(b)(1) elements, plus amendments.
- Indirect rate support: the negotiated rate agreement, or the subrecipient's written de minimis election.
- Any specific conditions and the notice sent to the federal agency.
- Each financial and performance report received, with evidence of review: initials, questions asked, invoices tested.
- Site visit and technical assistance records, if the risk plan called for them.
- Audit verification: the subrecipient's latest Single Audit from the FAC, or written confirmation it was below the threshold.
- Findings log: related findings, the subrecipient's corrective action plan, and the management decision.
- Closeout documents.
On timing, 2 CFR 200.521(d) requires the management decision within six months of the FAC's acceptance of the audit report, and it must cite the auditor's finding reference numbers (200.521(e)). For cross-cutting findings it may rely on the subrecipient's cognizant or oversight agency for audit, if the subrecipient has a current Single Audit and is not excluded, but it still owns findings specific to its subaward (200.332(e)(4)).
A worked scenario
The organization and figures here are hypothetical.
A regional food bank holds a federal award. It plans three payments:
| Partner | What it does | Call | Why |
|---|---|---|---|
| Neighborhood pantry network, $300,000 | Screens households for eligibility, runs distribution, reports outcomes against program goals | Subrecipient | Determines eligibility, makes program decisions, measured on program objectives |
| Refrigerated trucking company, $90,000 | Hauls pallets on a schedule the food bank sets | Contractor | Normal business service sold to many buyers in a competitive market |
| Evaluation consultant, $40,000 | Runs the outcome evaluation the food bank reports to the agency | Contractor, with flow-down | A purchased service that supports program reporting, so its duties go in the contract (200.501(h)) |
The pantry network has no negotiated rate and elects 12 percent de minimis; the food bank cannot cap it at 10. It replaced its finance director last spring, a 200.332(c)(3) factor, so it gets quarterly invoice testing and a site visit. The food bank's own MTDC picks up $50,000 of the subaward and all $130,000 of the contracts.
How weak subrecipient monitoring shows up in a Single Audit
The FAC's findings workbook tags each finding by compliance requirement type, and "M. Subrecipient monitoring" is one. Misclassification can also land under "I. Procurement and suspension and debarment" or "B. Allowable costs/cost principles."
In our interpretation, every 200.332 duty without evidence in the file is a candidate finding. The ones we would test first: subawards missing required data elements, no documented risk assessment, no check that subrecipients were audited, and partners paid as vendors with no determination memo. Read the condition and cause in each finding before drawing conclusions. The SEFA line for amounts provided to subrecipients tells you whether the duty applies at all; our guide to reading Single Audit findings covers the rest.
What an outsourced accounting firm can offer
Our interpretation: this is controller and grants compliance work a firm already knows how to do.
- A written subrecipient vs contractor policy with a determination template
- A subaward template built from the 200.332(b) list, reviewed against each award's terms
- A risk assessment form that covers fraud risk and ties ratings to monitoring steps
- Quarterly desk reviews of subrecipient invoices and reports
- An annual FAC check of every subrecipient, a management decision tracker, and a SEFA reconciled to the ledger
Nonprofits that just started passing funds through, or have an M finding on file, are the likeliest buyers. That is an inference to test.
How AwardNote uses this
Each AwardNote opportunity pairs an award trigger, such as a nonprofit's first subawards or a growing pass-through line on its SEFA, with a finance capacity signal, labels the evidence Verified, Inferred, or Unknown, and suggests who to approach and how to open the conversation. If you want to see that research applied to the nonprofits you serve, start with a $149 pilot: 14 days, 5 researched opportunities, no auto-renewal.
Sources
All retrieved October 29, 2026.
- 2 CFR 200.331, Subrecipient and contractor determinations (eCFR): ecfr.gov
- 2 CFR 200.332, Requirements for pass-through entities (eCFR): ecfr.gov
- 2 CFR 200.1, Definitions (eCFR): ecfr.gov
- 2 CFR 200.414, Indirect costs (eCFR): ecfr.gov
- 2 CFR 200.501, Audit requirements (eCFR): ecfr.gov
- 2 CFR 200.510, Financial statements (eCFR): ecfr.gov
- 2 CFR 200.521, Management decisions (eCFR): ecfr.gov
- OMB, Guidance for Federal Financial Assistance, 89 FR 30046 (April 22, 2024): Federal Register
- Federal Audit Clearinghouse, SF-SAC Section 3: Federal awards audit findings: fac.gov
FAQ
What is subrecipient monitoring?
The duties a pass-through entity owes when it passes part of a federal award to another organization: an exclusion check, a compliant subaward, a fraud and noncompliance risk evaluation, review of reports, follow-up on audit findings, and verification that the subrecipient was audited as required (2 CFR 200.332).
How do you tell a subrecipient from a contractor?
Under 2 CFR 200.331, a subrecipient carries out part of the federal program: it decides eligibility, makes program decisions, and is measured on program objectives. A contractor sells goods or services in its normal business, usually to many buyers. Substance governs over the agreement's label, and no single factor decides it.
Can a pass-through entity cap a subrecipient's indirect cost rate?
It must accept a federally negotiated rate. A subrecipient without one may elect a de minimis rate of up to 15 percent of MTDC, and a pass-through entity may not require a lower rate unless a federal statute or regulation requires it (2 CFR 200.414(d) and (f); 200.332(b)(4)).
How long does a pass-through entity have to issue a management decision?
Six months from the FAC's acceptance of the subrecipient's audit report, under 2 CFR 200.521(d).
Do payments to contractors count toward the contractor's Single Audit threshold?
No. Federal awards expended as a recipient or subrecipient are subject to audit; payments received for goods or services as a contractor are not (2 CFR 200.501(g)).
